name: Prepare release

on:
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      tag_name:
        description: 'Tag name (e.g. v1.2.3)'
        required: true
        type: string

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  update-package-version-and-push-commit:
    runs-on: ubuntu-22.04
    if: ${{ startsWith(github.event.release.tag_name || inputs.tag_name, 'v') }}
    permissions:
      contents: write
    env:
      TAG_NAME: ${{ github.event.release.tag_name || inputs.tag_name }}
    steps:
      - name: checkout
        uses: actions/checkout@v4
        with:
          # SSH deploy key (GH_ACTIONS_PUSH_TO_MAIN) is a ruleset bypass actor,
          # so pushes made with it skip the PR / merge-queue requirement on main.
          # The default GITHUB_TOKEN is not a bypass actor and gets rejected.
          ssh-key: ${{ secrets.GH_ACTIONS_PUSH_TO_MAIN }}
          ref: main

      - name: update-manifest
        run: |
          version_number=$(echo "$TAG_NAME" | sed 's/^v//')
          yq -i -o=json ".version = \"${version_number}\"" package.json

      - name: update-manifest
        run: |
          version_number=$(echo "$TAG_NAME" | sed 's/^v//')
          yq -i -o=json ".version = \"${version_number}\"" manifest-binary.json

      - name: bump-version
        run: |
          version_number=$(echo "$TAG_NAME" | sed 's/^v//')
          sed -i "s/export const VERSION = \".*\";/export const VERSION = \"${version_number}\";/" src/version.ts

      - name: check-changes
        id: check
        run: |
          if git diff --quiet; then
            echo "changed=false" >> "$GITHUB_OUTPUT"
          else
            echo "changed=true" >> "$GITHUB_OUTPUT"
          fi

      - name: check-version
        if: steps.check.outputs.changed == 'true'
        run: |
          old=$(git show HEAD:package.json | yq -r .version)
          new=$(yq -r .version package.json)
          if [[ "$(printf '%s\n%s\n' "$old" "$new" | sort -V | tail -n1)" != "$new" ]]; then
            echo "Error: new version $new is not greater than previous $old"
            exit 1
          fi

      - name: commit
        if: steps.check.outputs.changed == 'true'
        # Plain git push (not a commit action) on purpose: the checkout above
        # authenticated with the GH_ACTIONS_PUSH_TO_MAIN SSH deploy key, and that
        # deploy key is the ruleset bypass actor allowed to push to the protected
        # `main`. A commit action using the default GITHUB_TOKEN (github-actions
        # bot) is NOT a bypass actor and gets rejected ("changes must be made
        # through a pull request / merge queue"). The bot user.name/email below is
        # only for commit attribution — auth is the deploy key from checkout.
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git add package.json manifest-binary.json src/version.ts
          git commit -m "Release version '${TAG_NAME}'"
          git push origin HEAD:main