name: Release

# A RELEASE BUILDS NOTHING. That is the whole point of this lane (M314 step 7).
#
# The merge to `main` already published everything a user can receive: the server
# image as `:latest` + `:<sha>`, the desktop bundles and the APK to the `stable`
# channel, and the updater manifest that advertises them. A tag rebuilding that same
# source would produce identical artifacts under identical names, and would re-push
# `:<sha>` with different bytes — which rule 145 forbids even when they match.
#
# So the tag is a BOOKMARK, and this lane gives it the only job it has left: saying
# what was in it. Note 3127 §5 — there are two halves to "what am I running", and
# the version answers only the first:
#
#   which build is this?          the footer, /api/config, the APK's versionName
#   what changed since the one    ← this
#     I was running last month?
#
# Cutting the tag is the operator's act (rule 2). This only responds to one.
#
# THE TAG IS NOT AN IMAGE TAG and never becomes one. `ci.yml` does not trigger on
# tags at all. The image is addressed by channel or by commit; the release by date.
# Same string as the artifact version (rule 148, `vYYYY.MM.DD.HHMM`), different
# system.

on:
  push:
    tags: ["v*"]

permissions:
  contents: write

jobs:
  notes:
    name: Write the changelog
    runs-on: python-ci
    container:
      image: git.fabledsword.com/bvandeusen/ci-python:3.14
    steps:
      - uses: actions/checkout@v6
        with:
          # The whole history AND every tag: the notes are the commit range between
          # this tag and the previous `v*` one, and neither end exists in a shallow
          # clone. A depth-limited checkout here does not fail — it produces a
          # shorter changelog, which is the kind of wrong nobody notices.
          fetch-depth: 0

      - name: Publish the release notes
        env:
          GITHUB_TOKEN: ${{ github.token }}
        run: |
          notes="$(sh packaging/release-notes.sh "$GITHUB_REF_NAME")"
          echo "$notes"
          echo "---"

          # JSON-escaped HERE rather than in publish-release.sh, which cannot assume
          # python3 is on PATH in the three images that call it. `json.dumps` then
          # strip the surrounding quotes — the script supplies those.
          RELEASE_BODY_JSON="$(printf '%s' "$notes" \
            | python3 -c 'import json,sys; print(json.dumps(sys.stdin.read())[1:-1])')"
          export RELEASE_BODY_JSON

          # Through publish-release.sh for its create-or-PATCH-on-409 path: a
          # release that is only ever POSTed keeps whatever body its first run
          # wrote (#2182), so re-tagging or re-running must rewrite it. No bundles
          # exist in this workspace, so its asset globs match nothing and it
          # uploads none — which is the intended behaviour, not a side effect.
          RELEASE_TAG="$GITHUB_REF_NAME" bash desktop/packaging/publish-release.sh