name: Publish release

# A `v*` tag builds the binary and attaches it to the Gitea release as
# `iris`, with the tag's CHANGELOG.md section as the notes. Content
# repos pin IRIS_RELEASE to one of these tags in their lint workflow.

on:
  push:
    tags: ["v*"]

jobs:
  publish:
    runs-on: bare
    env:
      CARGO_HOME: /var/local/cargo
      RUSTUP_HOME: /var/local/rustup
      PATH: /var/local/cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/bin
      SCCACHE_DIR: /var/local/sccache
      SCCACHE_SERVER_PORT: "4228"
      CARGO_TARGET_DIR: /var/local/cargo-target
    steps:
      - uses: actions/checkout@v4

      - name: Build
        run: cargo build --release

      - name: Publish release
        run: |
          set -euo pipefail
          tag="${{ github.ref_name }}"
          api="${{ github.server_url }}/api/v1/repos/${{ github.repository }}"
          auth="Authorization: token ${{ secrets.GITHUB_TOKEN }}"
          notes=$(awk -v v="${tag#v}" '/^## /{p = ($2 == v)} p' CHANGELOG.md | tail -n +2)
          body=$(jq -n --arg tag "$tag" --arg notes "$notes" '{tag_name: $tag, name: $tag, body: $notes}')
          id=$(curl -sf -X POST -H "$auth" -H 'Content-Type: application/json' \
            -d "$body" "$api/releases" | jq .id) \
            || id=$(curl -sf -H "$auth" "$api/releases/tags/$tag" | jq .id)
          for aid in $(curl -sf -H "$auth" "$api/releases/$id/assets" | jq '.[].id'); do
            curl -sf -X DELETE -H "$auth" "$api/releases/$id/assets/$aid"
          done
          curl -sf -X POST -H "$auth" \
            -F "attachment=@/var/local/cargo-target/release/iris" \
            "$api/releases/$id/assets?name=iris" > /dev/null
          echo "published $tag"