name: CI

on:
  push:
    branches: [main]
    tags: ['*']
  pull_request:
    branches: [main]

enable-openid-connect: true

jobs:
  build:
    name: build
    runs-on: debian-latest
    container: mcr.microsoft.com/dotnet/sdk:10.0@sha256:0d99ebf1ccad15037b5c98c9fe8979d6b8dbac23812feae2277a0b277b5c5ffa
    steps:
      - name: checkout
        uses: https://code.geekeey.de/actions/checkout@54953ce9d6c7d0a9cbd89d185c5b2c7515358c5f # 1

      - name: dotnet pack
        shell: bash
        env:
          TAG: ${{ forgejo.ref }}
          TAG_NAME: ${{ forgejo.ref_name }}
        run: |
          set -euo pipefail

          if [[ "$TAG" == refs/tags/* ]]; then
            version="${TAG_NAME#v}"
            if ! printf '%s' "$version" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$'; then
              echo "::error::Tag '$TAG_NAME' is not a valid release version (expected MAJOR.MINOR.PATCH)"
              exit 1
            fi
            export version
          fi

          dotnet pack arcade.slnx

      - name: upload packages
        uses: https://code.geekeey.de/actions/artifacts/push@ae8d20e174a8706675e6d54ebd3719a2802ea9dd # 1
        with:
          name: nuget-packages
          path: artifacts/package/release
          pattern: |
            *.nupkg
            *.snupkg

      - name: publish to nuget
        if: startsWith(forgejo.ref, 'refs/tags/')
        shell: bash
        env:
          AUDIENCE: "u:1:00000000-0000-0000-0000-000000000000"
        run: |
          set -euo pipefail

          if [[ -z "${ACTIONS_ID_TOKEN_REQUEST_URL:-}" || -z "${ACTIONS_ID_TOKEN_REQUEST_TOKEN:-}" ]]; then
            echo "::error::OpenID Connect is not enabled. Set enable-openid-connect: true on the workflow or job."
            exit 1
          fi

          response=$(curl --fail --silent --show-error \
            --header "Authorization: bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=${AUDIENCE}")
          token=$(printf '%s' "${response}" | grep --only-matching '"value":"[^"]*"' | cut --delimiter '"' --fields 4)

          if [[ -z "${token}" ]]; then
            echo "::error::Failed to obtain an OpenID Connect token from Forgejo."
            exit 1
          fi

          echo "::add-mask::${token}"

          feed="${{ forgejo.server_url }}/api/packages/${{ forgejo.repository_owner }}/nuget/index.json"

          dotnet nuget add source --name forgejo --username forgejo-publish --password "$token" --store-password-in-clear-text "$feed"
          dotnet nuget push "artifacts/package/release/*.nupkg" "artifacts/package/release/*.snupkg" --source forgejo --skip-duplicate