name: Test, build, release

on:
  workflow_dispatch:
  push:
    paths-ignore:
      - '**.md'
      - '**/release.yaml'
    branches:
      - main

permissions:
  id-token: write
  contents: write
  packages: write

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  release:
    uses: lukaszraczylo/shared-actions/.github/workflows/go-release.yaml@main
    with:
      go-version: ">=1.27"
      docker-enabled: true
      rolling-release-tag: "v1"
      semver-config: "config-release.yaml"
    secrets: inherit

  update-action-version:
    needs: release
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main' && needs.release.outputs.version != ''
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.sha }}
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Update action.yml with release version
        env:
          VERSION: ${{ needs.release.outputs.version }}
        run: |
          echo "Updating action.yml to version: ${VERSION}"
          sed -i "s|ghcr.io/lukaszraczylo/semver-generator:[^\"]*|ghcr.io/lukaszraczylo/semver-generator:${VERSION}|" action.yml
          echo "Updated action.yml:"
          grep "image:" action.yml

      - name: Commit and push
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add action.yml
          if git diff --staged --quiet; then
            echo "No changes to commit"
          else
            git commit -m "chore: pin action.yml Docker image to v${{ needs.release.outputs.version }}"
            # Push the pin commit onto main explicitly (not just "git push"):
            # this checkout started from the released commit (github.sha), not
            # main's tip, so if main moved in the meantime this push is a
            # non-fast-forward and fails safely instead of overwriting it.
            git push origin HEAD:main
            # Only move the rolling tag once the pin commit is confirmed on
            # main. The "release" job above already moved it to the release
            # commit, but this job then commits action.yml's image pin on top
            # of that, so without this the rolling tag would always be one
            # commit behind, pinning the PREVIOUS image.
            # "v1" must match the release job's rolling-release-tag input.
            git tag -f v1 HEAD
            git push -f origin refs/tags/v1
          fi