name: Release

on:
  push:
    branches:
      - master

permissions:
  contents: write # to create release (changesets/action)
  pull-requests: write # to create pull request (changesets/action)
  attestations: write # to create attestation during publish step (@actions/attest)
  id-token: write # to create OIDC token for attestation

jobs:
  build-artifacts:
    uses: ./.github/workflows/build.yaml

  release:
    runs-on: macos-latest
    needs: build-artifacts
    timeout-minutes: 15
    steps:
      - name: Checkout code repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
        with:
          fetch-depth: 0
          submodules: true

      - name: Download new artifacts
        id: download-artifact
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          artifact-ids: ${{ needs.build-artifacts.outputs.artifactId }}

      - name: Display structure of downloaded files
        run: ls -R artifacts-staging

      - name: Setup pnpm
        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
        with:
          version: 9.4.0
          run_install: false
  
      - name: Setup node
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: '22'
          cache: 'pnpm'
  
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
        shell: bash
      
      - name: Create versions PR & prepare publish
        id: changesets
        uses: changesets/action@06245a4e0a36c064a573d4150030f5ec548e4fcc # v1.4.1
        with:
          version: "pnpm ci:version"
          publish: "pnpm ci:publish"
          commit: 'chore(deploy): Release'
          title: 'chore(deploy): Release'
          createGithubReleases: false
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Create scoped releases
        if: steps.changesets.outputs.published == 'true'
        run: |
          echo "Releases created with tags: ${{ steps.changesets.outputs.publishedPackages }}"
          node scripts/changeset-publish.js
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PUBLISHED_PACKAGES: ${{ steps.changesets.outputs.publishedPackages }}

      
