name: Publish Q-SYS plugins

# Packs every plugin under plugins/ and pushes any NEW versions to this
# Gitea instance's NuGet registry. Versions that already exist in the feed
# are skipped, so publishing a revision is just:
#   bump <version> in the plugin's .nuspec -> commit -> push to main.
#
# Required repository secret:
#   PACKAGE_TOKEN - a Gitea personal access token with package read/write
#                   scope for the owner account/org.

# Beta channel: MANUAL publish only, same as production. Run it from
# Actions -> "Publish Q-SYS plugins" -> Run workflow when a beta build is
# ready. (To auto-publish on every commit to a beta build instead, add the
# push: block back - beta is low-stakes, but manual keeps it deliberate.)
on:
  workflow_dispatch:

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Set up .NET SDK
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: "8.0.x"

      - name: Install PowerShell
        run: dotnet tool install --global PowerShell --version 7.4.6

      - name: Pack all plugins
        run: ~/.dotnet/tools/pwsh ./tools/pack.ps1 -OutputDir dist

      - name: Verify PACKAGE_TOKEN secret
        run: |
          if [ -z "${{ secrets.PACKAGE_TOKEN }}" ]; then
            echo "::error::PACKAGE_TOKEN is EMPTY - the secret is missing, misnamed, or not visible to this repo's workflows"
            exit 1
          fi
          code=$(curl -s -o /dev/null -w "%{http_code}" \
            -H "Authorization: token ${{ secrets.PACKAGE_TOKEN }}" \
            "${{ github.server_url }}/api/v1/packages/${{ github.repository_owner }}?type=nuget&limit=1")
          echo "Token validity check (package API): HTTP $code  (200 = valid)"
          if [ "$code" != "200" ]; then
            echo "::error::PACKAGE_TOKEN is present but Gitea rejects it - regenerate the token"
            exit 1
          fi

      - name: Push new versions to Gitea NuGet registry
        # Primary: dotnet client with a named basic-auth source (Gitea's
        # documented method). Fallback: direct multipart PUT with diagnostics.
        run: |
          feed="${{ github.server_url }}/api/packages/${{ github.repository_owner }}/nuget"
          dotnet nuget add source "$feed/index.json" --name gitea \
            --username "${{ github.actor }}" \
            --password "${{ secrets.PACKAGE_TOKEN }}" \
            --store-password-in-clear-text
          if dotnet nuget push "dist/*.nupkg" --source gitea --skip-duplicate; then
            echo "Published via dotnet client."
            exit 0
          fi
          echo "dotnet push failed - trying direct multipart upload..."
          fail=0
          for f in dist/*.nupkg; do
            code=$(curl -s -o /tmp/push-resp -w "%{http_code}" \
              -u "${{ github.actor }}:${{ secrets.PACKAGE_TOKEN }}" \
              -X PUT -F "package=@$f;type=application/octet-stream" "$feed/")
            case "$code" in
              201) echo "PUBLISHED: $f" ;;
              409) echo "skipped (version already in feed): $f" ;;
              *)   echo "::error::HTTP $code pushing $f"; cat /tmp/push-resp; echo; fail=1 ;;
            esac
          done
          exit $fail