on:
  workflow_call:

jobs:
  publish:
    runs-on: ubuntu-22.04

    env:
      HIVE_TOKEN: ${{ secrets.HIVE_TOKEN }}
      # AWS_* are used by Oclif CLI
      AWS_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
      AWS_S3_ENDPOINT: https://6d5bc18cd8d13babe7ed321adba3d8ae.r2.cloudflarestorage.com

    outputs:
      publish: ${{ steps.cli.outputs.publish }}
      version: ${{ steps.cli.outputs.version }}

    steps:
      - name: checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 2
          token: ${{ secrets.GUILD_BOT_TOKEN }}

      - name: setup environment
        uses: ./.github/actions/setup
        with:
          codegen: false # no need to run because release script will run it anyway
          actor: release-stable
          cacheTurbo: true

      - name: prepare npm credentials
        run: |
          echo "//registry.npmjs.org/:_authToken=$NPM_TOKEN" >> $HOME/.npmrc
        env:
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

      - name: publish stable
        id: changesets
        uses: changesets/action@v1.4.9
        with:
          publish: pnpm release
          commit: 'chore(release): update monorepo packages versions'
          title: 'Upcoming Release Changes'
        env:
          GITHUB_TOKEN: ${{ secrets.GUILD_BOT_TOKEN }}

      - name: extract published cli version
        if:
          steps.changesets.outputs.published && contains(steps.changesets.outputs.publishedPackages,
          '"@graphql-hive/cli"')
        id: cli
        run: |
          echo '${{steps.changesets.outputs.publishedPackages}}' > cli-ver.json
          VERSION=`echo $(jq -r '.[] | select(.name | endswith("@graphql-hive/cli")).version' cli-ver.json)`
          echo "version=$VERSION" >> $GITHUB_OUTPUT
          echo "publish=true" >> $GITHUB_OUTPUT

      # Needed for `oclif pack win`
      - name: Install NSIS
        run: |
          sudo apt-get -y install nsis

      - name: pack tarballs
        if: steps.cli.outputs.publish == 'true'
        working-directory: packages/libraries/cli
        run: pnpm oclif:pack

      - name: upload tarballs
        if: steps.cli.outputs.publish == 'true'
        working-directory: packages/libraries/cli
        run: pnpm oclif:upload

      - name: promote tarballs
        if: steps.cli.outputs.publish == 'true'
        working-directory: packages/libraries/cli
        env:
          VERSION: ${{ steps.cli.outputs.version }}
        run: pnpm oclif promote --no-xz --sha ${GITHUB_SHA:0:7} --version $VERSION

  publish_docker_cli:
    needs: [publish]
    uses: ./.github/workflows/dockerize-cli.yaml
    if: ${{ needs.publish.outputs.publish == 'true' }}
    with:
      cliVersion: ${{ needs.publish.outputs.version }}
    secrets: inherit