name: Build and Release FEDEO

on:
  push:
    branches: [dev, main]
  workflow_dispatch:

jobs:
  verify:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.sha }}
          fetch-depth: 0
      - uses: actions/setup-node@v4
        with:
          node-version: '22'
      - run: npm ci --ignore-scripts --no-audit --no-fund
      - name: Test release planning and recovery
        run: npm test
      - name: Check Conventional Commits
        run: npm run commits:check

  build-and-release:
    needs: verify
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.sha }}
          fetch-depth: 0
          # dev uses the normal read-only checkout; only main needs a release writer.
          token: ${{ github.ref == 'refs/heads/main' && (secrets.RELEASE_TOKEN || vars.RELEASE_TOKEN || vars.CI_TOKEN || secrets.CI_TOKEN) || github.token }}
      - uses: actions/setup-node@v4
        with:
          node-version: '22'
      - run: npm ci --ignore-scripts --no-audit --no-fund
      - uses: docker/setup-buildx-action@v3
      - uses: docker/login-action@v3
        with:
          registry: git.federspiel.tech
          username: flfeders
          # Same credential source as the existing image-build workflows.
          password: ${{ vars.CI_TOKEN || secrets.CI_TOKEN }}
      - name: Build all images and publish main releases
        # main uses a Git ref lock. dev only reads Git and writes to the registry.
        env:
          CI: 'true'
          FEDEO_REF: ${{ github.ref }}
          FEDEO_SHA: ${{ github.sha }}
          FEDEO_EVENT_NAME: ${{ github.event_name }}
          GITEA_TOKEN: ${{ github.ref == 'refs/heads/main' && (secrets.RELEASE_TOKEN || vars.RELEASE_TOKEN || vars.CI_TOKEN || secrets.CI_TOKEN) || '' }}
        run: npm run release:ci