# Publishes onixbyte-identity-generator to Maven Central when a version tag is pushed to main.
#
# Supported tag format: <major>.<minor>.<patch>[-suffix]  (e.g. 3.3.1, 3.3.1-alpha)

name: Publish Package to Maven Central

on:
  push:
    tags:
      - '[0-9]*.[0-9]*.[0-9]*'

jobs:
  publish:
    name: Build and Publish
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - name: Checkout
        uses: actions/checkout@v4.2.2
        with:
          fetch-depth: 0

      - name: Verify Tag is on Main Branch
        run: |
          if ! git merge-base --is-ancestor HEAD origin/main; then
            echo "::error::Tag ${{ github.ref_name }} does not point to a commit on the main branch"
            echo "Tags must be pushed after the commit is merged to main."
            exit 1
          fi
          echo "✓ Tag ${{ github.ref_name }} is on main"

      - name: Extract Version
        id: version
        run: |
          VERSION="${{ github.ref_name }}"
          echo "version=${VERSION}" >> $GITHUB_OUTPUT
          echo "Version: ${VERSION}"

      - name: Setup GPG TTY
        run: export GPG_TTY=$(tty)

      - name: Import PGP Private Key
        uses: crazy-max/ghaction-import-gpg@v6.3.0
        with:
          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
          trust_level: 5

      - name: Creating PGP Ring Key
        run: |
          mkdir -p ~/.gnupg
          gpg --batch --yes --export-secret-keys -o ~/.gnupg/gpg_key.ring

      - name: Restore gradle.properties
        env:
          GRADLE_PROPERTIES: ${{ secrets.GRADLE_PROPERTIES }}
        shell: bash
        run: |
          mkdir -p ~/.gradle/
          echo "GRADLE_USER_HOME=${HOME}/.gradle" >> $GITHUB_ENV
          echo "${GRADLE_PROPERTIES}" > ~/.gradle/gradle.properties

      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          java-version: "17"
          distribution: "corretto"

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@v4.4.1

      - name: Grant Execution Authority to Gradlew
        run: chmod +x ./gradlew

      - name: Build with Gradle
        env:
          VERSION: ${{ steps.version.outputs.version }}
        run: ./gradlew build "-PartefactVersion=${VERSION}"

      - name: List Output Items
        run: ls -l ./build/libs

      - name: Publish to Maven Central
        env:
          VERSION: ${{ steps.version.outputs.version }}
        run: ./gradlew publish "-PartefactVersion=${VERSION}"

      - name: Create Deployment on Central Publisher Portal
        run: |
          curl --fail -X 'POST' \
            'https://ossrh-staging-api.central.sonatype.com/manual/upload/defaultRepository/com.onixbyte?publishing_type=user_managed' \
            -H 'accept: */*' \
            -H 'Authorization: Bearer ${{ secrets.MAVEN_PORTAL_TOKEN }}' \
            -d ''