# Release: tag X.Y.Z → έλεγχος έκδοσης · build · types · tests → npm publish (Trusted Publishing, provenance, χωρίς token / OTP) → GitHub Release
#
#   npm version patch          # ή minor / major — ο αριθμός παντού + CHANGELOG, commit + tag
#   git push --follow-tags
#
# Χειροκίνητα (Actions → Release → Run workflow) για ένα υπάρχον tag:
#   - dry run: build, tests και pack, χωρίς δημοσίευση
#   - έκδοση που υπάρχει ήδη στο npm: μόνο το GitHub Release (σημειώσεις από το CHANGELOG του main)
#
# Μία φορά στο npmjs.com: country-select-pro → Settings → Trusted Publisher → GitHub Actions:
#   nikmauro / country-select-pro / release.yml (Allow npm publish)
name: Release

on:
  push:
    tags: ['[0-9]+.[0-9]+.[0-9]+']
  workflow_dispatch:
    inputs:
      tag:
        description: 'Existing tag, e.g. 6.4.0'
        required: true
      dry_run:
        description: 'Dry run: build, test and pack – no npm publish, no GitHub Release'
        type: boolean
        default: true

permissions:
  contents: write   # GitHub Release
  id-token: write   # npm Trusted Publishing (OIDC) + provenance

concurrency:
  group: release-${{ github.event.inputs.tag || github.ref_name }}
  cancel-in-progress: false

jobs:
  release:
    runs-on: ubuntu-latest
    timeout-minutes: 45
    env:
      TAG: ${{ github.event.inputs.tag || github.ref_name }}
      DRY_RUN: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.dry_run == 'true' }}
    steps:
      # push tag → ο κώδικας του tag · χειροκίνητα → το main (CHANGELOG / scripts), το tag παρακάτω
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - uses: actions/setup-node@v7
        with:
          node-version: 24
          registry-url: https://registry.npmjs.org

      - name: Already on npm?
        id: npm
        run: |
          if npm view "country-select-pro@$TAG" version > /dev/null 2>&1; then
            echo "published=true" >> "$GITHUB_OUTPUT"
            echo "country-select-pro@$TAG is already on npm – GitHub Release only"
          else
            echo "published=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Release notes (CHANGELOG)
        run: node scripts/release-notes.js "$TAG" > "$RUNNER_TEMP/notes.md" && cat "$RUNNER_TEMP/notes.md"

      - name: Check out the tag
        if: steps.npm.outputs.published == 'false'
        run: git checkout --quiet "refs/tags/$TAG"

      - name: npm with Trusted Publishing (>= 11.5.1)
        if: steps.npm.outputs.published == 'false'
        run: npm install -g npm@^11.5.1 && npm --version

      - name: Same version in tag, package.json and source
        if: steps.npm.outputs.published == 'false'
        run: |
          PKG=$(node -p "require('./package.json').version")
          SRC=$(node -p "require('fs').readFileSync('dist/country-select.js','utf8').match(/const VERSION = '([^']+)'/)[1]")
          echo "tag $TAG · package.json $PKG · source $SRC"
          test "$TAG" = "$PKG" && test "$TAG" = "$SRC"

      - name: Install
        if: steps.npm.outputs.published == 'false'
        run: npm install --no-audit --no-fund

      - name: Build
        if: steps.npm.outputs.published == 'false'
        run: npm run build

      - name: TypeScript types
        if: steps.npm.outputs.published == 'false'
        run: npm run check:types

      # Όλοι οι browsers ελέγχονται από το CI σε κάθε push (ίδιος κώδικας). Εδώ μόνο Chromium, ΧΩΡΙΣ πακέτα Linux (--with-deps / apt-get,
      # που μπορεί να αργήσει πολύ): ο runner έχει ήδη το Google Chrome και τις βιβλιοθήκες του.
      - name: Playwright Chromium (no system packages)
        if: steps.npm.outputs.published == 'false'
        run: npx playwright install chromium

      - name: Tests (Chromium, source + minified)
        if: steps.npm.outputs.published == 'false'
        run: npx playwright test --project=chromium --project=chromium-min

      - name: npm publish
        if: steps.npm.outputs.published == 'false'
        run: |
          if [ "$DRY_RUN" = "true" ]; then
            npm publish --dry-run
          else
            npm publish --provenance --access public
          fi

      - name: GitHub Release
        if: env.DRY_RUN != 'true'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          NEWEST=$(git tag --list '[0-9]*.[0-9]*.[0-9]*' --sort=-v:refname | head -1)
          LATEST=$([ "$TAG" = "$NEWEST" ] && echo true || echo false)
          if gh release view "$TAG" > /dev/null 2>&1; then
            gh release edit "$TAG" --notes-file "$RUNNER_TEMP/notes.md"
          else
            gh release create "$TAG" --title "$TAG" --notes-file "$RUNNER_TEMP/notes.md" --verify-tag --latest="$LATEST"
          fi

      - name: Test report
        if: failure()
        uses: actions/upload-artifact@v7
        with:
          name: playwright-report
          path: |
            playwright-report/
            test-results/
          retention-days: 7