name: TallyNote release

on:
  push:
    tags:
      - "v*.*.*"

# A tag is the immutable input to a release. Publishing is kept in one job so
# SHA256SUMS covers every archive exactly once and the Gitea Release API never
# receives duplicate checksum assets from parallel architecture jobs.
permissions:
  contents: write

jobs:
  linux-x64:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout tag
        uses: actions/checkout@v4
      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 24
      - name: Enable pnpm
        run: corepack enable && corepack prepare pnpm@9.0.6 --activate
      - name: Verify tag and test gate
        run: |
          set -euo pipefail
          test "$(node -p 'require("./package.json").version')" = "${GITHUB_REF_NAME#v}"
          pnpm install --frozen-lockfile
          pnpm check
          pnpm test
      - name: Build Linux release
        run: pnpm release:build "${GITHUB_REF_NAME#v}" ./release
      - name: Create and publish signed Gitea Release
        env:
          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
          TALLYNOTE_RELEASE_SIGNING_KEY: ${{ secrets.TALLYNOTE_RELEASE_SIGNING_KEY }}
        run: ./scripts/publish-gitea-release.sh "$GITHUB_REF_NAME" ./release

  # Linux x86 (i386/i686) is intentionally not published: Node.js 24 and the
  # better-sqlite3/argon2/sharp native modules have no maintained 32-bit build.
  # Add an ARM64 job only on a runner with native ARM64 support, then let the
  # publisher aggregate all archives before signing one SHA256SUMS file.