---
name: "Release"
on:
  workflow_dispatch:
  pull_request_target:
    types: [closed]
    branches:
      - main
jobs:
  release:
    permissions:
      contents: write       # Create release and push tags
      pull-requests: read   # Read PR labels for release-drafter
      packages: write       # Push container image to ghcr.io
      id-token: write       # Federate for artifact attestation
      attestations: write   # Generate build provenance attestations
      discussions: write    # Create release announcement discussion
    uses: github-community-projects/ospo-reusable-workflows/.github/workflows/release.yaml@13d124b245cf85ba41d9dd58d6888979043f1a29 # v1.2.3
    with:
      publish: true
      release-config-name: release-drafter.yml
      release-only-with-label: true
    secrets:
      github-token: ${{ secrets.GITHUB_TOKEN }}
  publish-cue:
    needs: release
    if: needs.release.outputs.full-tag != ''
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
      - name: Setup Cue
        uses: cue-lang/setup-cue@a93fa358375740cd8b0078f76355512b9208acb1 # v1.0.1
        with:
          version: "v0.15.1"
      - name: Login to Central Registry
        run: cue login --token=${{ secrets.CUE_REG_TOKEN }}
      - name: Publish the module
        run: cue mod publish ${{ needs.release.outputs.full-tag }}
  publish-openapi:
    # The website (and other downstream type generators) consume the spec's
    # OpenAPI projection, so attach it to the release as an asset.
    needs: release
    if: needs.release.outputs.full-tag != ''
    runs-on: ubuntu-latest
    permissions:
      contents: write   # Upload the release asset
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ needs.release.outputs.full-tag }}
          persist-credentials: false
      - name: Setup Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: '1.25'
      - name: Generate openapi.yaml
        run: make genopenapi
      - name: Upload release asset
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG: ${{ needs.release.outputs.full-tag }}
        run: gh release upload "$TAG" generated/openapi.yaml --clobber
  notify-website:
    # The website repo regenerates its schema reference pages from the
    # released spec, so tell it a new release exists. This must happen here
    # rather than in an `on: release` workflow in the website repo: the
    # release is created with GITHUB_TOKEN, whose events do not trigger
    # other workflows.
    #
    # Runs after publish-openapi so the rebuild finds the openapi.yaml
    # asset already attached instead of racing the upload.
    needs: [release, publish-openapi]
    if: needs.release.outputs.full-tag != ''
    runs-on: ubuntu-latest
    permissions: {}
    steps:
      - name: Generate GitHub App token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        id: app-token
        with:
          client-id: ${{ secrets.GEMARA_AUTOMATION_CLIENT_ID }}
          private-key: ${{ secrets.GEMARA_AUTOMATION_PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}
          repositories: website
          permission-contents: write
      - name: Trigger website rebuild
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          TAG: ${{ needs.release.outputs.full-tag }}
        with:
          github-token: ${{ steps.app-token.outputs.token }}
          script: |
            await github.rest.repos.createDispatchEvent({
              owner: context.repo.owner,
              repo: 'website',
              event_type: 'gemara-release',
              client_payload: { ref: process.env.TAG },
            });