name: Build and publish extension

on:
  push:
    tags:
      - "v*"

concurrency:
  group: publish-release
  cancel-in-progress: false

permissions:
  contents: write

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - name: Check out source
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.x"

      - name: Install pinned CRX builder
        run: python -m pip install --disable-pip-version-check "crx3==0.0.4"

      - name: Build and verify signed extension
        env:
          CRX_PRIVATE_KEY: ${{ secrets.CRX_PRIVATE_KEY }}
        run: |
          set -eu
          key_file="$(mktemp)"
          trap 'rm -f "$key_file"' EXIT
          if [ -z "$CRX_PRIVATE_KEY" ]; then
            printf '%s\n' 'CRX_PRIVATE_KEY repository secret is required' >&2
            exit 1
          fi
          umask 077
          printf '%s' "$CRX_PRIVATE_KEY" > "$key_file"
          chmod 600 "$key_file"
          python scripts/build_extension.py \
            --tag "${{ gitea.ref_name }}" \
            --private-key "$key_file" \
            --output-dir "$RUNNER_TEMP/history-collector-build"

      - name: Publish Gitea release assets
        env:
          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
          GITEA_API_URL: ${{ gitea.server_url }}/api/v1
          GITEA_REPOSITORY: ${{ gitea.repository }}
        run: |
          set -eu
          python scripts/publish_release.py \
            --tag "${{ gitea.ref_name }}" \
            --directory "$RUNNER_TEMP/history-collector-build"