name: build-extension

# Build + release only on version tags. Daily dev/test runs live in ci.yml.
on:
  push:
    tags: ['v*']

# Ensure the job token can create releases and upload assets.
permissions:
  contents: write
  releases: write

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Node
        uses: actions/setup-node@v4
        with:
          node-version: 20

      - name: Install dev dependencies
        run: npm ci || npm install

      - name: Install PyMuPDF + openpyxl (PDF text + XLSX validation)
        run: |
          python3 -m venv /tmp/venv
          /tmp/venv/bin/pip install --quiet pymupdf openpyxl
          echo "/tmp/venv/bin" >> "$GITHUB_PATH"

      - name: Run tests
        run: npm test

      - name: Validate exports open in real readers
        run: node scripts/validate-exports.js

      - name: Build both variants
        run: node scripts/build.js all

      - name: Sign Firefox build (xpi for permanent install)
        # Optional: only runs when the AMO credentials exist as repo secrets.
        # Signing requires a version AMO has not seen before — bump
        # manifest.json before tagging (1.2.0 and 1.3.0 are already on AMO).
        if: env.AMO_JWT_ISSUER != '' && env.AMO_JWT_SECRET != ''
        env:
          AMO_JWT_ISSUER: ${{ secrets.AMO_JWT_ISSUER }}
          AMO_JWT_SECRET: ${{ secrets.AMO_JWT_SECRET }}
        run: |
          set -euo pipefail
          npm run sign
          XPI=$(ls dist/*.xpi | head -1)
          VERSION=$(node -p "require('./dist/firefox/manifest.json').version")
          mv "$XPI" "dist/ismis-helper-${VERSION}-an+fx.xpi"

      - name: Publish release
        # Gitea-native release: softprops/action-gh-release targets GitHub's API
        # and fails on Gitea (405). Instead we call the Gitea API directly with
        # the runner-provided GITHUB_TOKEN and GITHUB_API_URL.
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          REPO="${{ github.repository }}"
          TAG="${{ github.ref_name }}"
          API="${GITHUB_API_URL:-https://git.ranio.xyz/api/v1}"
          # Create the release for the tag
          RELEASE_JSON=$(curl -sS -X POST \
            -H "Authorization: token ${GITHUB_TOKEN}" \
            -H "Content-Type: application/json" \
            -d "{\"tag_name\":\"${TAG}\",\"name\":\"${TAG}\",\"body\":\"ISMIS Helper ${TAG}\"}" \
            "${API}/repos/${REPO}/releases")
          RELEASE_ID=$(echo "${RELEASE_JSON}" | python3 -c "import sys,json; print(json.load(sys.stdin)['id'])")
          # Attach zips and the signed xpi (if present) as release assets
          for f in dist/*.zip dist/*.xpi; do
            [ -f "$f" ] || continue
            NAME="$(basename "$f")"
            # URL-encode the asset name so characters like '+' (in
            # 'ismis-helper-1.4.0-an+fx.xpi') survive the query string instead
            # of being decoded to a space.
            ENC=$(python3 -c "import urllib.parse,sys; print(urllib.parse.quote(sys.argv[1], safe=''))" "$NAME")
            curl -sS -X POST \
              -H "Authorization: token ${GITHUB_TOKEN}" \
              -F "attachment=@${f}" \
              "${API}/repos/${REPO}/releases/${RELEASE_ID}/assets?name=${ENC}"
          done