ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  build:
    name: Build and Test
    runs-on: macos-14
    steps:
      - uses: actions/checkout@v7

      - name: Select Xcode
        run: sudo xcode-select -s /Applications/Xcode_15.2.app

      - name: Build
        run: swift build -c release

      - name: Run Tests
        run: swift test

  build-linux:
    name: Build and Test (Linux)
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v7

      - uses: swift-actions/setup-swift@v2
        with:
          swift-version: "5.9"

      - name: Build CLI
        run: swift build --product PastewatchCLI

      - name: Run Tests
        run: swift test

  lint:
    name: Lint
    runs-on: macos-14
    steps:
      - uses: actions/checkout@v7

      - name: Install SwiftLint
        run: brew install swiftlint

      - name: Run SwiftLint
        run: swiftlint lint --strict

  auto-tag:
    name: Auto-tag version bumps
    runs-on: ubuntu-22.04
    needs: [build, build-linux, lint]
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    permissions:
      contents: write
      actions: write
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 1

      - name: Check for version bump commit
        id: check
        run: |
          MSG=$(git log -1 --format='%s')
          if echo "$MSG" | grep -qE '^chore: bump version to [0-9]+\.[0-9]+\.[0-9]+$'; then
            VERSION=$(echo "$MSG" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+')
            echo "version=$VERSION" >> "$GITHUB_OUTPUT"
            echo "should_tag=true" >> "$GITHUB_OUTPUT"
          else
            echo "should_tag=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Create and push tag
        id: tag
        if: steps.check.outputs.should_tag == 'true'
        env:
          # WO-520@v2: the built-in token suppresses recursive tag-push workflows;
          # the following explicit dispatch is the sole automated release trigger.
          GH_TOKEN: ${{ github.token }}
        run: |
          TAG="v${{ steps.check.outputs.version }}"
          if git ls-remote --tags origin | grep -q "refs/tags/$TAG$"; then
            echo "Tag $TAG already exists on remote — skipping"
            echo "pushed=false" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          git tag "$TAG"
          git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${{ github.repository }}.git"
          git push origin "$TAG"
          echo "pushed=true" >> "$GITHUB_OUTPUT"

      # Tags pushed from within Actions do not re-trigger release.yml's `on: push: tags`
      # (GitHub's recursive-workflow guard), so dispatch it explicitly for the tag we just
      # created. Only runs on the real-push path — never on the "tag already exists" skip.
      - name: Trigger release workflow
        if: steps.tag.outputs.pushed == 'true'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          TAG="v${{ steps.check.outputs.version }}"
          gh workflow run release.yml --repo "${{ github.repository }}" --ref main -f tag="$TAG"