name: Release

on:
  push:
    tags:
      - "*.*.*"

permissions:
  contents: write
  id-token: write
  attestations: write

jobs:
  release:
    name: Build and release
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          persist-credentials: false

      - name: Setup Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: 24
          package-manager-cache: false

      - name: Install dependencies
        run: npm ci --ignore-scripts

      - name: Check release version
        run: npm run release:check
        env:
          RELEASE_VERSION: ${{ github.ref_name }}

      - name: Run checks and build
        run: npm run check:ci

      - name: Generate artifact attestations
        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4
        with:
          subject-path: |
            main.js
            manifest.json
            styles.css

      - name: Create GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ github.ref_name }}
        run: |
          NOTES_FILE=".github/release-notes/$TAG.md"
          if [ ! -f "$NOTES_FILE" ]; then
            echo "Release notes file is required at $NOTES_FILE"
            exit 1
          fi

          if gh release view "$TAG" >/dev/null 2>&1; then
            gh release edit "$TAG" \
              --title "$TAG" \
              --notes-file "$NOTES_FILE" \
              --verify-tag
          else
            gh release create "$TAG" \
              main.js manifest.json styles.css \
              --title "$TAG" \
              --notes-file "$NOTES_FILE" \
              --verify-tag
          fi