# This workflow is main release, needs to be manually tagged & pushed.
on:
  push:
    paths-ignore:
      - "documentation/**"
    tags:
      - "v1.*"

name: Release
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  # ------------------------------------
  # 1) Build CLI for multiple OS/Arch
  # ------------------------------------
  build-cli:
    uses: ./.github/workflows/build-cli.yml

  # ------------------------------------
  # 2) Upload Install CLI Script
  # ------------------------------------
  install-script:
    name: Upload Install Script
    runs-on: ubuntu-latest
    needs: [build-cli]
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # pin@v4
      - uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # pin@v4
        with:
          name: download_cli.sh
          path: download_cli.sh

  # ------------------------------------------------------------
  # 3) Bundle Desktop App (macOS)
  # ------------------------------------------------------------
  bundle-desktop:
    uses: ./.github/workflows/bundle-desktop.yml
    with:
      signing: true
    secrets:
      CERTIFICATE_OSX_APPLICATION: ${{ secrets.CERTIFICATE_OSX_APPLICATION }}
      CERTIFICATE_PASSWORD: ${{ secrets.CERTIFICATE_PASSWORD }}
      APPLE_ID: ${{ secrets.APPLE_ID }}
      APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
      APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}

  # ------------------------------------------------------------
  # 4) Bundle Desktop App (macOS)
  # ------------------------------------------------------------
  bundle-desktop-intel:
    uses: ./.github/workflows/bundle-desktop-intel.yml
    with:
      signing: true
    secrets:
      CERTIFICATE_OSX_APPLICATION: ${{ secrets.CERTIFICATE_OSX_APPLICATION }}
      CERTIFICATE_PASSWORD: ${{ secrets.CERTIFICATE_PASSWORD }}
      APPLE_ID: ${{ secrets.APPLE_ID }}
      APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
      APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}

#  # ------------------------------------------------------------
#  # 5) Bundle Desktop App (Windows)
#  # ------------------------------------------------------------
#  bundle-desktop-windows:
#    uses: ./.github/workflows/bundle-desktop-windows.yml
#    # Signing is disabled by default until we have a certificate
#    with:
#      signing: false
#    # Uncomment and configure these when we have a certificate:
#    # secrets:
#    #   WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
#    #   WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}

  # ------------------------------------
  # 6) Create/Update GitHub Release
  # ------------------------------------
  release:
    name: Release
    runs-on: ubuntu-latest
    needs: [build-cli, install-script, bundle-desktop, bundle-desktop-intel]
    permissions:
      contents: write
    steps:
      - name: Download all artifacts
        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # pin@v4
        with:
          merge-multiple: true

      # Create/update the versioned release
      - name: Release versioned
        uses: ncipollo/release-action@440c8c1cb0ed28b9f43e4d1d670870f059653174 # pin@v1
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          artifacts: |
            goose-*.tar.bz2
            Goose*.zip
            download_cli.sh
          allowUpdates: true
          omitBody: true
          omitPrereleaseDuringUpdate: true

      # Create/update the stable release
      - name: Release stable
        uses: ncipollo/release-action@440c8c1cb0ed28b9f43e4d1d670870f059653174 # pin@v1
        with:
          tag: stable
          name: Stable
          token: ${{ secrets.GITHUB_TOKEN }}
          artifacts: |
            goose-*.tar.bz2
            Goose*.zip
            download_cli.sh
          allowUpdates: true
          omitBody: true
          omitPrereleaseDuringUpdate: true