name: Build PCM package

on:
  push:
    branches: [main]
    tags: ["v*"]
  workflow_dispatch:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      # third-party actions pinned to commit SHAs: mutable tags could be
      # repointed at malicious code that runs with repo/token access
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          # the annotated tag carries the release notes, and checkout
          # fetches with --no-tags unless asked - at any fetch-depth
          fetch-depth: 0
          fetch-tags: true

      - name: Check tag matches metadata.json version
        if: startsWith(github.ref, 'refs/tags/v')
        run: |
          meta=$(python3 -c "import json; print(json.load(open('metadata.json'))['versions'][0]['version'])")
          tag="${GITHUB_REF_NAME#v}"
          if [ "$meta" != "$tag" ]; then
            echo "tag v$tag does not match metadata.json version $meta" >&2
            exit 1
          fi

      - name: Build package
        run: python3 tools/build_package.py

      - name: Upload artifact
        uses: actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3
        with:
          name: pcm-package
          path: |
            dist/*.zip
            dist/metadata-registry.json

      # the action does not fall back to the tag annotation, so an
      # un-bodied release publishes with empty notes (as v1.2.0 did)
      - name: Release notes from the annotated tag
        if: startsWith(github.ref, 'refs/tags/v')
        run: |
          git tag -l --format='%(contents:body)' "$GITHUB_REF_NAME" \
            > release-notes.md
          if [ ! -s release-notes.md ]; then
            echo "no annotated message on $GITHUB_REF_NAME - refusing to" \
                 "publish a release with empty notes" >&2
            exit 1
          fi
          cat release-notes.md

      - name: Create release with the zip, registry metadata and figures
        if: startsWith(github.ref, 'refs/tags/v')
        uses: akkuman/gitea-release-action@b8d9144f302c68610911db1aaf722708d5c02d94 # v1
        with:
          body_path: release-notes.md
          files: |
            dist/*.zip
            dist/metadata-registry.json
            docs/img/*.png
          token: ${{ secrets.GITEA_TOKEN }}