name: extension
on:
  push:
    branches: [dev, main]
    paths: ['extension/**']
  workflow_dispatch:

jobs:
  lint:
    runs-on: python-ci
    container:
      image: node:22-bookworm-slim
    steps:
      - uses: actions/checkout@v4
      - name: Install web-ext
        run: cd extension && npm install --no-save --no-audit --no-fund
      - name: Lint
        run: cd extension && npm run lint

  sign-and-publish:
    needs: lint
    if: github.ref == 'refs/heads/main'
    runs-on: python-ci
    container:
      image: node:22-bookworm-slim
    steps:
      - uses: actions/checkout@v4
        with:
          token: ${{ secrets.RELEASE_TOKEN }}
      - name: Install web-ext + git
        run: |
          apt-get update && apt-get install -y --no-install-recommends git ca-certificates
          cd extension && npm install --no-save --no-audit --no-fund
      - name: Sign XPI
        run: cd extension && npm run sign
        env:
          WEB_EXT_API_KEY: ${{ secrets.MOZILLA_AMO_JWT_KEY }}
          WEB_EXT_API_SECRET: ${{ secrets.MOZILLA_AMO_JWT_SECRET }}
      - name: Commit signed XPI to frontend/public/extension/
        run: |
          set -e
          XPI=$(ls extension/web-ext-artifacts/fabledcurator-*.xpi | head -1)
          if [ -z "$XPI" ]; then
            echo "No XPI produced by web-ext sign — exiting"
            exit 1
          fi
          mkdir -p frontend/public/extension
          cp "$XPI" frontend/public/extension/
          # Also copy as -latest.xpi so the FC server can serve a stable URL.
          cp "$XPI" "frontend/public/extension/fabledcurator-latest.xpi"
          git config user.name  "FC extension CI"
          git config user.email "noreply@fabledsword.com"
          git add frontend/public/extension/
          if git diff --cached --quiet; then
            echo "No changes to commit"
          else
            git commit -m "ext: publish signed XPI $(basename $XPI)"
            git push origin HEAD:main
          fi