name: release

on:
  push:
    tags: ['v*']

permissions:
  contents: read

concurrency:
  group: release-${{ github.ref }}

jobs:
  gate:
    runs-on: ubuntu-latest
    outputs:
      release: ${{ steps.check.outputs.release }}
    steps:
      # The tag filter accepts v1.2.3-rc1 too; only plain vX[.Y.Z] tags
      # are releases, everything else makes this job a no-op so the
      # publish job reports "skipped" instead of failing.
      - id: check
        run: |
          if [[ "$GITHUB_REF_NAME" =~ ^v[0-9]+(\.[0-9]+)*$ ]]; then
            echo "release=true" >> "$GITHUB_OUTPUT"
          else
            echo "release=false" >> "$GITHUB_OUTPUT"
          fi

  build-snap:
    needs: gate
    if: needs.gate.outputs.release == 'true'
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            artifact: snap-amd64
          # GitHub's free arm64 runners build the arm64 snap natively:
          # libkrun compiles there, and the libkrunfw part picks the
          # arm64 pool .deb through CRAFT_ARCH_BUILD_FOR. riscv64 is a
          # declared platform but has no hosted runner: build and
          # publish that snap by hand (snapcraft remote-build).
          - os: ubuntu-24.04-arm
            artifact: snap-arm64
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v4

      - name: Stamp the tag version into the manifests
        run: |
          v="${GITHUB_REF_NAME#v}"
          sed -i "s/^version = \".*\"/version = \"$v\"/" Cargo.toml
          # The snap adopts this version from Cargo.toml at pull time.
          grep -H '^version' Cargo.toml

      - uses: snapcore/action-build@v1
        id: build

      - uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.artifact }}
          path: ${{ steps.build.outputs.snap }}

  publish-snap:
    needs: build-snap
    runs-on: ubuntu-latest
    steps:
      - uses: actions/download-artifact@v4
        with:
          pattern: snap-*
          path: snaps

      - name: Resolve the snap paths
        id: paths
        run: |
          echo "amd64=$(ls snaps/snap-amd64/*.snap)" >> "$GITHUB_OUTPUT"
          echo "arm64=$(ls snaps/snap-arm64/*.snap)" >> "$GITHUB_OUTPUT"

      # Requires the SNAP_STORE_LOGIN secret: the output of
      #   snapcraft export-login --snaps ecrou --channels stable -
      - uses: snapcore/action-publish@v1
        env:
          SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAP_STORE_LOGIN }}
        with:
          snap: ${{ steps.paths.outputs.amd64 }}
          release: stable

      - uses: snapcore/action-publish@v1
        env:
          SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAP_STORE_LOGIN }}
        with:
          snap: ${{ steps.paths.outputs.arm64 }}
          release: stable