name: Build PCM package

on:
  push:
    branches: [main]
    tags: ["v*"]
  workflow_dispatch:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      # third-party actions pinned to commit SHAs: mutable tags could be
      # repointed at malicious code that runs with repo/token access
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - name: Check tag matches metadata.json version
        if: startsWith(github.ref, 'refs/tags/v')
        run: |
          meta=$(python3 -c "import json; print(json.load(open('metadata.json'))['versions'][0]['version'])")
          tag="${GITHUB_REF_NAME#v}"
          if [ "$meta" != "$tag" ]; then
            echo "tag v$tag does not match metadata.json version $meta" >&2
            exit 1
          fi

      - name: Build package
        run: python3 tools/build_package.py

      - name: Upload artifact
        uses: actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3
        with:
          name: pcm-package
          path: |
            dist/*.zip
            dist/metadata-registry.json

      # The release body comes from a file in the repo: the action does
      # not fall back to the tag annotation (v1.2.0 published empty), and
      # reading the annotation here is unreliable - checkout leaves the
      # tag lightweight, so %(contents) yields the commit message instead.
      - name: Check the release notes exist
        if: startsWith(github.ref, 'refs/tags/v')
        run: |
          notes="docs/release-notes/${GITHUB_REF_NAME}.md"
          if [ ! -s "$notes" ]; then
            echo "$notes is missing or empty - write the release notes" \
                 "before tagging" >&2
            exit 1
          fi
          cat "$notes"

      - name: Create release with the zip, registry metadata and figures
        if: startsWith(github.ref, 'refs/tags/v')
        uses: akkuman/gitea-release-action@b8d9144f302c68610911db1aaf722708d5c02d94 # v1
        with:
          body_path: docs/release-notes/${{ github.ref_name }}.md
          files: |
            dist/*.zip
            dist/metadata-registry.json
            docs/img/*.png
          token: ${{ secrets.GITEA_TOKEN }}