name: Publish @bytelyst/* packages

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      dry_run:
        description: 'Build + pack but skip publish'
        required: false
        default: 'true'
      package_filter:
        description: 'Optional package name to restrict publish/dry-run, e.g. @bytelyst/errors'
        required: false
        default: '@bytelyst/*'

concurrency:
  group: publish-${{ github.ref }}
  cancel-in-progress: false

jobs:
  publish:
    runs-on: [ubuntu-latest, bytelyst, hostinger]
    container:
      image: node:20-bookworm@sha256:8f693eaa7e0a8e71560c9a82b55fd54c2ae920a2ba5d2cde28bac7d1c01c9ba5
      options: --network host -v /home/gitea-runner/.gitea_publish_npmrc:/run/secrets/gitea_publish_npmrc:ro

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          github-server-url: https://gitea.bytelyst.com

      - name: Print build context
        run: |
          echo "Ref:     ${{ github.ref }}"
          echo "RefName: ${{ github.ref_name }}"
          echo "Commit:  ${{ github.sha }}"
          echo "Runner:  $(hostname)"
          grep '^PRETTY_NAME=' /etc/os-release || true
          node --version
          npm --version

      - name: Install pinned pnpm
        run: |
          npm install -g pnpm@10.6.5
          pnpm --version

      - name: Configure publish registry
        run: |
          cp /run/secrets/gitea_publish_npmrc /tmp/publish.npmrc
          chmod 600 /tmp/publish.npmrc
          echo "Configured registry:"
          sed -E 's#(_auth(Token)?=).*#\1***#; s#(//[^[:space:]]+:)_authToken=.*#\1_authToken=***#' /tmp/publish.npmrc
          npm whoami --userconfig /tmp/publish.npmrc --registry https://gitea.bytelyst.com/api/packages/bytelyst/npm/

      - name: Install workspace deps
        run: HUSKY=0 pnpm install --frozen-lockfile

      - name: Discover unpublished packages
        env:
          PACKAGE_FILTER: ${{ inputs.package_filter || '@bytelyst/*' }}
        run: |
          set -euo pipefail
          : > /tmp/packages-to-publish.tsv
          for pkg_json in packages/*/package.json; do
            name=$(node -p "require('./$pkg_json').name")
            version=$(node -p "require('./$pkg_json').version")
            dir=$(dirname "$pkg_json")
            case "$name" in
              @bytelyst/*) ;;
              *) continue ;;
            esac
            case "$PACKAGE_FILTER" in
              '@bytelyst/*'|'') ;;
              "$name") ;;
              *) continue ;;
            esac
            if npm view "$name@$version" version --userconfig /tmp/publish.npmrc --registry https://gitea.bytelyst.com/api/packages/bytelyst/npm/ >/dev/null 2>&1; then
              echo "SKIP already published: $name@$version"
            else
              echo "QUEUE publish: $name@$version ($dir)"
              printf '%s\t%s\t%s\n' "$name" "$version" "$dir" >> /tmp/packages-to-publish.tsv
            fi
          done
          echo "Queued packages:"
          cat /tmp/packages-to-publish.tsv || true

      - name: Build, test, pack, and optionally publish queued packages
        env:
          DRY_RUN: ${{ inputs.dry_run || 'false' }}
        run: |
          set -euo pipefail
          mkdir -p /tmp/tarballs
          if [ ! -s /tmp/packages-to-publish.tsv ]; then
            echo "No unpublished packages matched the filter; nothing to do."
            exit 0
          fi
          while IFS=$'\t' read -r name version dir; do
            echo "=== $name@$version ==="
            pnpm --filter "$name" run build
            pnpm --filter "$name" test
            (cd "$dir" && pnpm pack --pack-destination /tmp/tarballs)
            if [ "$DRY_RUN" = "true" ]; then
              echo "DRY RUN: skipping publish for $name@$version"
            else
              (cd "$dir" && pnpm publish --no-git-checks --userconfig /tmp/publish.npmrc --registry https://gitea.bytelyst.com/api/packages/bytelyst/npm/)
              npm view "$name@$version" dist.shasum --userconfig /tmp/publish.npmrc --registry https://gitea.bytelyst.com/api/packages/bytelyst/npm/
            fi
          done < /tmp/packages-to-publish.tsv

      - name: Compute tarball SHA512 manifest
        run: |
          set -euo pipefail
          cd /tmp/tarballs
          if ls *.tgz >/dev/null 2>&1; then
            sha512sum *.tgz > manifest.sha512
            cat manifest.sha512
          else
            echo "No tarballs produced" > manifest.sha512
            cat manifest.sha512
          fi