ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

jobs:
  verify:
    uses: ./.github/workflows/verify.yml

  release-version:
    needs: verify
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    permissions:
      contents: write
      actions: write
    concurrency:
      group: versioned-release-${{ github.repository }}
      cancel-in-progress: false
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - uses: actions/setup-node@v6
        with:
          node-version: 22
      - name: Tag the tested version and explicitly dispatch Release
        env:
          GH_TOKEN: ${{ github.token }}
        shell: bash
        run: |
          VERSION=$(node scripts/release-version.mjs --check)
          TAG="v$VERSION"
          MAIN_SHA=$(git ls-remote origin refs/heads/main | cut -f 1)
          if [[ "$MAIN_SHA" != "$GITHUB_SHA" ]]; then
            echo 'A newer main commit will own the version release.' >> "$GITHUB_STEP_SUMMARY"
            exit 0
          fi
          if git show-ref --verify --quiet "refs/tags/$TAG"; then
            TAG_SHA=$(git rev-parse "$TAG^{commit}")
            if [[ "$TAG_SHA" != "$GITHUB_SHA" ]]; then
              echo "Version $VERSION is already released; preserving its tag and skipping publication." >> "$GITHUB_STEP_SUMMARY"
              exit 0
            fi
          else
            git tag "$TAG" "$GITHUB_SHA"
            git push origin "$TAG"
          fi
          gh workflow run release.yml --repo "$GITHUB_REPOSITORY" --ref "$TAG"
          echo "Dispatched Release for $TAG at the tested commit $GITHUB_SHA." >> "$GITHUB_STEP_SUMMARY"