name: Release dry-run

on:
  workflow_dispatch:
    inputs:
      tag:
        description: "Tag/version to validate (e.g. v0.4.9)"
        required: true
        type: string

permissions:
  contents: read

jobs:
  dry_run:
    timeout-minutes: 45
    concurrency:
      group: release-dry-run-${{ inputs.tag }}
      cancel-in-progress: true
    runs-on: macos-15
    steps:
      - name: Checkout repository
        env:
          REPO: ${{ github.repository }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          REF: ${{ github.sha }}
          SERVER_URL: ${{ github.server_url }}
        run: |
          set -euo pipefail
          SERVER_HOST="${SERVER_URL#https://}"
          git init
          git remote add origin "https://x-access-token:${GH_TOKEN}@${SERVER_HOST}/${REPO}.git"
          git fetch --depth=1 origin "$REF"
          git checkout FETCH_HEAD

      - name: Run release preflight
        env:
          TAG: ${{ inputs.tag }}
        run: |
          set -euo pipefail
          scripts/ci/release_preflight.sh "$TAG"
