name: Release unsigned Firefox extension

on:
  release:
    types:
      - published

permissions:
  code: read
  releases: write

jobs:
  package-and-attach:
    name: Package and attach unsigned XPI
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - name: Check out the released tag
        uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262
        with:
          ref: ${{ gitea.event.release.tag_name }}
          fetch-depth: 1

      - name: Set up Node.js
        uses: https://github.com/actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
        with:
          node-version: 22

      - name: Run automated checks
        run: npm test

      - name: Build unsigned release archive
        env:
          GITEA_RELEASE_TAG: ${{ gitea.event.release.tag_name }}
        run: npm run package -- --version "${GITEA_RELEASE_TAG}" --output-dir dist

      - name: Verify release checksum
        run: sha256sum --check dist/*.xpi.sha256

      - name: Attach release assets
        env:
          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
          GITEA_SERVER_URL: ${{ gitea.server_url }}
          GITEA_REPOSITORY: ${{ gitea.repository }}
          GITEA_RELEASE_ID: ${{ gitea.event.release.id }}
        run: |
          set -eu
          for asset in dist/*.xpi dist/*.xpi.sha256; do
            name="$(basename "${asset}")"
            curl --fail-with-body --silent --show-error \
              --request POST \
              --header "Authorization: token ${GITEA_TOKEN}" \
              --form "attachment=@${asset}" \
              "${GITEA_SERVER_URL%/}/api/v1/repos/${GITEA_REPOSITORY}/releases/${GITEA_RELEASE_ID}/assets?name=${name}"
          done