# Publishes the worker artifact to the stable channel on a version tag. An
# install reads it at artifacts.pdsjs.dev.
on:
  push: {refs: [refs/tags/v*]}
superseded: finish
image: node:22-trixie
cache: [/root/.local/share/pnpm/store, /root/.cache/node/corepack]
runners: [ci.knotless.dev]
secrets: [PDSJS_SITE_TOKEN]
env:
  COREPACK_ENABLE_DOWNLOAD_PROMPT: "0"
  PDS_URL: https://pds.pdsjs.dev
  PDS_IDENTIFIER: pdsjs.dev
steps:
  - name: check credentials
    run: |
      if [ -z "${PDSJS_SITE_TOKEN:-}" ]; then
        echo "PDSJS_SITE_TOKEN is not granted, so this tag would publish nothing."
        echo "Seal it to ci.knotless.dev with knotless secret. It is an app password for $PDS_IDENTIFIER."
        exit 1
      fi
      echo "publishing to $PDS_URL as $PDS_IDENTIFIER"
  - name: build
    run: |
      corepack enable
      pnpm install --frozen-lockfile
      npm run build:ui
      npm run build:worker
      test -s dist/worker/index.js
      test -s dist/worker/manifest.json
  # The artifact carries the version an install reports, so a tag that
  # disagrees with it would mislabel every install.
  - name: check the tag names the artifact
    run: |
      tag="${KNOTLESS_RUN_REF#refs/tags/}"
      built=$(node -p 'require("./dist/worker/manifest.json").version')
      if [ "v$built" != "$tag" ]; then
        echo "the tag is $tag but the artifact says $built"
        exit 1
      fi
  - name: publish
    run: PDS_PASSWORD="$PDSJS_SITE_TOKEN" node scripts/publish-worker-artifact.mjs