name: Publish (The Source)

# Datacenter-side publish to The Source (source.soulcraft.com — our
# self-hosted Forgejo; never call it "the forge", Forge is a different
# product), moved off the laptop: an 87MB tarball PUT over the laptop's WAN
# times out; The Source's own runner does it in seconds.
# scripts/release.sh tags + pushes, then polls this workflow's result (npm
# view against The Source's registry) before it ever touches the npmjs leg —
# see the "delegation contract" in scripts/release.sh's home-publish step.

on:
  push:
    tags:
      - 'v*'

jobs:
  publish:
    name: Publish to The Source registry
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '22'
          cache: npm
      - run: npm ci
      - run: npm run build
      - name: Publish + readback-verify on The Source registry
        env:
          # The stored repo-settings secret keeps its historical name.
          FORGE_NPM_TOKEN: ${{ secrets.FORGE_NPM_TOKEN }}
        run: |
          set -eo pipefail

          SOURCE_NPM_REG="https://source.soulcraft.com/api/packages/soulcraftlabs/npm/"
          VERSION="$(node -p "require('./package.json').version")"
          # The dist-tag follows the version: a prerelease (any hyphen —
          # 10.4.0-rc.1) publishes under 'rc' and must NEVER move 'latest' —
          # every consumer resolving 'latest' from this registry would otherwise
          # be handed a release candidate. Same rule scripts/release.sh applies
          # to the storefront leg.
          NPM_TAG="latest"
          case "$VERSION" in
            *-*) NPM_TAG="rc" ;;
          esac
          echo "Publishing @soulcraftlabs/brainy@${VERSION} to The Source registry (dist-tag: ${NPM_TAG})..."

          TMPRC="$(mktemp)"
          chmod 600 "$TMPRC"
          {
            echo "@soulcraftlabs:registry=${SOURCE_NPM_REG}"
            echo "//source.soulcraft.com/api/packages/soulcraftlabs/npm/:_authToken=${FORGE_NPM_TOKEN}"
          } > "$TMPRC"

          # The release script bumps package.json's version before it tags, so
          # this tag's checkout already carries the version being published —
          # nothing here re-derives it from the tag name.
          PUBLISH_OK=true
          if ! npm publish --tag "$NPM_TAG" --userconfig "$TMPRC"; then
            PUBLISH_OK=false
          fi

          # Readback verify is the source of truth, run regardless of the publish
          # exit code: a benign duplicate publish (a prior run, or a mirror, already
          # landed this exact version) reports failure even though the registry
          # already holds the right content.
          LANDED_VERSION="$(npm view "@soulcraftlabs/brainy@${VERSION}" version --userconfig "$TMPRC" 2>/dev/null || echo "")"
          rm -f "$TMPRC"

          if [ "$LANDED_VERSION" != "$VERSION" ]; then
            echo "::error::Readback verify FAILED — The Source registry reports version '${LANDED_VERSION:-<none>}', expected '${VERSION}'. This is a genuine publish failure, not a benign duplicate."
            exit 1
          fi

          if [ "$PUBLISH_OK" = true ]; then
            echo "Published and verified @soulcraftlabs/brainy@${VERSION} on The Source registry."
          else
            echo "::warning::npm publish reported failure, but readback confirms @soulcraftlabs/brainy@${VERSION} is already live on The Source (a prior run or mirror landed it) — treating this run as successful, since the registry content is correct. Any OTHER failure mode would have failed the readback check above instead."
          fi