name: Publish Maven packages

# Flash's own POM keeps `2.1.0-SNAPSHOT` as its committed version — that's what local
# `mvn install` (Pathway's normal dev loop, see its pom.xml `flash.version` comment) always
# produces, and changing it here would break that. Gitea's Maven registry, unlike a real
# snapshot repository, refuses to re-publish an existing name+version (must delete first —
# see https://docs.gitea.com/usage/packages/maven#publish-a-package), so every push instead
# publishes under a throwaway version stamped with the commit it built from
# (`2.1.0-<short-sha>`), via `versions:set` on a checkout copy — never touching the committed
# POMs. Consumers (Pathway's `docker` Maven profile) pin `flash.version` to one specific
# published build and bump it by hand to pick up newer Flash changes; see
# pathway/pom.xml's `docker` profile for the other half of this.
on:
  push:
    branches: [master]

jobs:
  publish:
    runs-on: ubuntu-latest
    # Deploy got a 401 without this: this repo's default Actions token permission mode is
    # Restricted (read-only on packages), not Permissive — see
    # https://docs.gitea.com/usage/actions/token-permissions.
    permissions:
      packages: write
    # No actions/checkout here on purpose: it's a Node-based action, and this container
    # (chosen for its preinstalled mvn/JDK 21) has no Node — checkout would fail with
    # "node: executable file not found". A plain git clone needs neither.
    container:
      image: maven:3.9-eclipse-temurin-21
    steps:
      - name: Checkout
        run: |
          apt-get update && apt-get install -y --no-install-recommends git
          git clone https://git.pixel-services.com/Relism/Flash5.git .
          git checkout ${{ gitea.sha }}

      - name: Stamp every module with a commit-scoped version
        run: |
          SHORT_SHA=$(git rev-parse --short HEAD)
          mvn -B versions:set -DnewVersion="2.1.0-${SHORT_SHA}" -DprocessAllModules=true -DgenerateBackupPoms=false
          echo "Publishing as 2.1.0-${SHORT_SHA}"

      # Diagnostic for the 401s seen so far: confirms GITEA_TOKEN actually reaches this step
      # non-empty, and whether the token itself authenticates against the API at all —
      # independent of whatever Maven/wagon-http does with it. Remove once deploy is green.
      - name: Debug token
        env:
          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
        run: |
          apt-get install -y --no-install-recommends curl >/dev/null
          echo "token length: ${#GITEA_TOKEN}"
          echo "whoami via token header:"
          curl -s -o /dev/null -w "  token header -> %{http_code}\n" -H "Authorization: token ${GITEA_TOKEN}" https://git.pixel-services.com/api/v1/user
          curl -s -o /dev/null -w "  basic auth   -> %{http_code}\n" -u "Relism:${GITEA_TOKEN}" https://git.pixel-services.com/api/v1/user

      - name: Deploy to the Gitea Maven registry
        env:
          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
        run: |
          mvn -B -s .gitea/maven-settings.xml -DskipTests deploy \
            -DaltReleaseDeploymentRepository=gitea::https://git.pixel-services.com/api/packages/Relism/maven \
            -DaltSnapshotDeploymentRepository=gitea::https://git.pixel-services.com/api/packages/Relism/maven