name: Publish

# Tag push after the commit already passed test.yaml (typical: push commit, then tag).
# https://go.dev/doc/modules/publishing
on:
  push:
    tags:
      - 'v*'

permissions:
  contents: read
  actions: read

jobs:
  publish:
    runs-on: selfhosted
    container:
      image: ghcr.io/catthehacker/ubuntu:go-latest
    steps:
      - name: Require passing test.yaml for this commit
        env:
          TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          api="${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}/actions/runs"
          body=$(curl -fsS -H "Authorization: token ${TOKEN}" \
            "${api}?head_sha=${GITHUB_SHA}&limit=50")
          if echo "$body" | jq -e '
            [.workflow_runs[]
             | select(.workflow_id == "test.yaml" or (.workflow_id | endswith("/test.yaml")))
             | select(.status == "success")
            ] | length > 0
          ' >/dev/null; then
            echo "test.yaml succeeded for ${GITHUB_SHA}"
            exit 0
          fi
          echo "No successful test.yaml run for ${GITHUB_SHA} run again once test.yaml is finished" >&2
          exit 1

      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.ref }}

      - name: Index and verify module on proxy.golang.org
        env:
          GOPROXY: https://proxy.golang.org
          GOSUMDB: sum.golang.org
        run: |
          set -euo pipefail
          module="$(awk '/^module / {print $2; exit}' go.mod)"
          version="${GITHUB_REF_NAME}"
          # https://go.dev/doc/modules/publishing — register the tag with the module index
          go list -m "${module}@${version}"
          # Fetch .mod/.zip through the proxy only (no direct fallback)
          go mod download "${module}@${version}"
          # Proxy protocol: cached versions expose these endpoints
          curl -fsS "https://proxy.golang.org/${module}/@v/${version}.info" >/dev/null
          curl -fsS "https://proxy.golang.org/${module}/@v/${version}.mod" >/dev/null
          curl -fsS "https://proxy.golang.org/${module}/@v/${version}.zip" >/dev/null
          echo "Module ${module}@${version} is available from proxy.golang.org"