name: Release

on:
  push:
    branches: [master]
  workflow_run:
    workflows: ["Lint and Test"]
    types:
      - completed
  workflow_dispatch:

env:
  CI: true

# every "Lint and Test" completion fires a Release; serialize them so
# concurrent runs never race at npm publish (409 over staged/published)
concurrency:
  group: release
  cancel-in-progress: false

jobs:
  release:
    permissions:
      id-token: write
      contents: write
      pull-requests: write
    runs-on: ubuntu-latest
    if: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.head_branch == 'master' }}
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
          fetch-tags: true
          ref: master
          # the workflows' own token; the repo GH_TOKEN PAT is expired and
          # breaks checkout auth on every workflow_run-triggered run
          token: ${{ github.token }}

      # trusted publishing (OIDC) needs Node >= 22.14 with npm >= 11.5.1;
      # the runner's default node/npm may be older
      - name: Set up Node
        uses: actions/setup-node@v7
        with:
          node-version: 24

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4
      - name: Set up Docker Buildx
        id: docker-buildx
        uses: docker/setup-buildx-action@v4
        with:
          platforms: linux/amd64,linux/arm64
          use: true
          cache-binary: true
          cleanup: true

      - name: Release
        env:
          BASE_BRANCH: ${{ github.event.repository.default_branch }}
          GIT_USERNAME: ${{ vars.GIT_USERNAME }}
          GIT_EMAIL: ${{ vars.GIT_EMAIL }}
          GITHUB_TOKEN: ${{ github.token }}
          SSH_PUBLIC_KEY: ${{ secrets.SSH_PUBLIC_KEY }}
          SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
          SSH_KEY_PASSPHRASE: ${{ secrets.SSH_KEY_PASSPHRASE }}
          # npm masks OIDC exchange failures as ENEEDAUTH (npm/cli#9923);
          # verbose exposes the registry's real rejection message
          NPM_CONFIG_LOGLEVEL: verbose
          DOCKER_HUB_USERNAME: ${{ vars.DOCKER_HUB_USERNAME }}
          DOCKER_HUB_PAT: ${{ secrets.DOCKER_HUB_PAT }}
          DOCKER_BUILDX_NAME: ${{ steps.docker-buildx.outputs.name }}
        shell: bash
        run: |
          bash ./release.sh --plugins=npm,npm-post,git,github-release,docker --pre-release