name: Release

on:
  workflow_dispatch:
    inputs:
      bump:
        description: "Semver bump (patch, minor, major)"
        required: false
        default: "patch"
  push:
    branches:
      - release

jobs:
  build-and-release:
    if: github.actor != 'github-actions[bot]'
    runs-on: ubuntu-latest
    permissions:
      contents: write

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          persist-credentials: true

      - name: Use Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Bump version and tag
        id: bump
        env:
          BUMP: ${{ inputs.bump }}
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          npm version "${BUMP:-patch}" -m "chore: release %s"
          VERSION=$(node -p "require('./package.json').version")
          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
          git push
          git push --tags

      - name: Build artifacts
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          npm run build

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: v${{ steps.bump.outputs.version }}
          name: Linear v${{ steps.bump.outputs.version }}
          draft: false
          prerelease: false
          files: |
            dist/*.AppImage
            dist/*.deb
            dist/*.rpm

      - name: Update flake.nix hashes
        env:
          VERSION: ${{ steps.bump.outputs.version }}
        run: |
          X86_HASH=$(sha256sum dist/linear-linux-${VERSION}-x86_64.AppImage | awk '{print $1}')
          ARM_HASH=$(sha256sum dist/linear-linux-${VERSION}-arm64.AppImage | awk '{print $1}')

          X86_SRI="sha256-$(echo -n "$X86_HASH" | python3 -c "import sys,base64,binascii; print(base64.b64encode(binascii.unhexlify(sys.stdin.read())).decode())")"
          ARM_SRI="sha256-$(echo -n "$ARM_HASH" | python3 -c "import sys,base64,binascii; print(base64.b64encode(binascii.unhexlify(sys.stdin.read())).decode())")"

          sed -i "s|version = \".*\";|version = \"${VERSION}\";|" flake.nix
          sed -i "s|hash = \"sha256-.*\"; # x86_64|hash = \"${X86_SRI}\"; # x86_64|" flake.nix
          sed -i "s|hash = \"sha256-.*\"; # aarch64|hash = \"${ARM_SRI}\"; # aarch64|" flake.nix

      - name: Commit flake.nix update
        env:
          VERSION: ${{ steps.bump.outputs.version }}
        run: |
          git add flake.nix
          if git diff --cached --quiet; then
            echo "No changes to flake.nix"
          else
            git commit -m "chore: update flake.nix hashes for v${VERSION}"
            git push
          fi