name: ForgeFlow signed release

on:
  push:
    branches: [main]
    paths:
      - package.json
  workflow_dispatch:

permissions:
  code: read
  releases: write

jobs:
  release:
    runs-on: windows-native
    steps:
      - uses: https://gitea.com/actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 2
      - uses: https://gitea.com/actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: 22
          cache: npm
      - name: Validate version bump and build release artifacts
        shell: powershell
        env:
          GITEA_EVENT_NAME: ${{ gitea.event_name }}
        run: |
          $ErrorActionPreference = "Stop"
          Set-StrictMode -Version Latest

          $manifest = Get-Content -LiteralPath "package.json" -Raw | ConvertFrom-Json
          $version = [string]$manifest.version
          $previousVersion = ""
          try {
            $previousJson = (& git show "HEAD^:package.json" 2>$null | Out-String)
            if ($LASTEXITCODE -eq 0 -and $previousJson.Trim()) {
              $previousVersion = [string](ConvertFrom-Json $previousJson).version
            }
          } catch {
            $previousVersion = ""
          }

          if ($env:GITEA_EVENT_NAME -eq "push" -and $previousVersion -eq $version) {
            Write-Host "package.json changed without a version bump ($version); no release will be published."
            exit 0
          }
          if ($version -notmatch '^\d+\.\d+\.\d+$') {
            throw "ForgeFlow version '$version' is not a stable semantic version."
          }

          & cmd.exe /d /s /c "npm ci --no-audit --no-fund"
          if ($LASTEXITCODE -ne 0) { throw "npm ci failed." }
          & cmd.exe /d /s /c "npx electron --version"
          if ($LASTEXITCODE -ne 0) { throw "Electron preflight failed." }
          & cmd.exe /d /s /c "npm run quality"
          if ($LASTEXITCODE -ne 0) { throw "ForgeFlow release quality gate failed." }
          & cmd.exe /d /s /c "npx playwright install chromium"
          if ($LASTEXITCODE -ne 0) { throw "Playwright Chromium installation failed." }
          & cmd.exe /d /s /c "npm run test:browser:ci"
          if ($LASTEXITCODE -ne 0) { throw "ForgeFlow browser acceptance suite failed." }
          & cmd.exe /d /s /c "npm audit --omit=dev --audit-level=high"
          if ($LASTEXITCODE -ne 0) { throw "ForgeFlow production dependency audit failed." }
          & cmd.exe /d /s /c "npx electron-builder --win nsis portable"
          if ($LASTEXITCODE -ne 0) { throw "ForgeFlow Windows build failed." }
          & node scripts/write-release-checksums.mjs
          if ($LASTEXITCODE -ne 0) { throw "ForgeFlow checksum generation failed." }

      - name: Sign and publish validated artifacts
        shell: powershell
        env:
          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
          FORGEFLOW_RELEASE_BASE_URL: ${{ gitea.server_url }}
          FORGEFLOW_RELEASE_OWNER: Jens
          FORGEFLOW_RELEASE_REPO: ForgeFlow
          FORGEFLOW_RELEASE_BRANCH: main
          FORGEFLOW_RELEASE_SIGNING_KEY_PEM: ${{ secrets.FORGEFLOW_RELEASE_SIGNING_KEY_PEM }}
        run: |
          $ErrorActionPreference = "Stop"
          Set-StrictMode -Version Latest
          $privateKeyPath = Join-Path $env:RUNNER_TEMP "forgeflow-release-signing-private.pem"
          try {
            if (-not $env:FORGEFLOW_RELEASE_SIGNING_KEY_PEM) {
              throw "FORGEFLOW_RELEASE_SIGNING_KEY_PEM is not configured."
            }
            if (-not $env:GITEA_TOKEN) {
              throw "GITEA_TOKEN is not configured."
            }
            $utf8NoBom = New-Object System.Text.UTF8Encoding($false)
            [System.IO.File]::WriteAllText($privateKeyPath, $env:FORGEFLOW_RELEASE_SIGNING_KEY_PEM, $utf8NoBom)
            $env:FORGEFLOW_UPDATE_SIGNING_PRIVATE_KEY = $privateKeyPath
            & node scripts/sign-release-manifest.mjs
            if ($LASTEXITCODE -ne 0) { throw "ForgeFlow manifest signing failed." }
            & node scripts/verify-release-signatures.mjs
            if ($LASTEXITCODE -ne 0) { throw "ForgeFlow release signature verification failed." }
            & node scripts/prune-dist.mjs
            if ($LASTEXITCODE -ne 0) { throw "ForgeFlow artifact pruning failed." }
            & .\node_modules\.bin\electron.cmd scripts/publish-binary-release.cjs
            if ($LASTEXITCODE -ne 0) { throw "ForgeFlow Gitea release publication failed." }
          } finally {
            $env:FORGEFLOW_UPDATE_SIGNING_PRIVATE_KEY = $null
            if (Test-Path -LiteralPath $privateKeyPath) {
              Remove-Item -LiteralPath $privateKeyPath -Force
            }
          }

          Write-Host "ForgeFlow artifacts were signed and published from exact main HEAD $env:GITEA_SHA."