name: Release

on:
  push:
    branches:
      - main

# Publishes each package by force-pushing its built output to a release branch
# (release/auth, release/payment) where the repo root IS the package. Consumers
# install straight over git:
#
#   "@marketplaces/auth": "git+<this repo>.git#release/auth"
#
# No npm registry, no NPM_TOKEN, no network reachability problem - the only
# credential needed is the checkout token this workflow already has.

jobs:
  release-branches:
    runs-on: ubuntu-latest
    permissions:
      contents: write
    strategy:
      matrix:
        package: [auth, payment]
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Build
        run: npm run build --workspace packages/${{ matrix.package }}

      - name: Publish to release/${{ matrix.package }}
        run: |
          set -euo pipefail
          PKG=${{ matrix.package }}
          BRANCH="release/$PKG"
          VERSION=$(node -p "require('./packages/$PKG/package.json').version")

          STAGE=$(mktemp -d)
          cp -r "packages/$PKG/dist" "$STAGE/dist"
          node -e "
            const p = require('./packages/$PKG/package.json');
            delete p.scripts;
            delete p.devDependencies;
            require('fs').writeFileSync('$STAGE/package.json', JSON.stringify(p, null, 2) + '\n');
          "
          cat > "$STAGE/README.md" <<EOF
          # @marketplaces/$PKG — release branch

          **Generated branch. Do not edit by hand.** Built from \`main\` at $GITHUB_SHA.

          Install:

          \`\`\`
          git+${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git#$BRANCH
          \`\`\`

          Source lives on \`main\` under \`packages/$PKG\`.
          EOF

          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

          git checkout --orphan "$BRANCH"
          git rm -rf --cached . > /dev/null
          find . -maxdepth 1 -not -name '.git' -not -name '.' -exec rm -rf {} +
          cp -r "$STAGE/." .

          git add -A
          if git diff --cached --quiet; then
            echo "No change for $PKG, nothing to publish."
            exit 0
          fi
          git commit -q -m "release: @marketplaces/$PKG $VERSION (built from $GITHUB_SHA)"
          git push -f origin "$BRANCH"

  version-pr:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm

      - name: Install dependencies
        run: npm ci

      # Opens/updates a "Version Packages" PR when unreleased changesets exist.
      # Merging that PR bumps versions on main, which re-runs release-branches above.
      - name: Version PR
        uses: changesets/action@v1
        with:
          version: npm run version
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}