release.yml

name: Release

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

defaults:
  run:
    shell: bash

jobs:
  version:
    name: Versión
    runs-on: ubuntu-latest
    timeout-minutes: 5
    outputs:
      version: ${{ steps.version.outputs.version }}
      tag: ${{ steps.version.outputs.tag }}
      prerelease: ${{ steps.version.outputs.prerelease }}
    steps:
      - name: Checkout
        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
        with:
          persist-credentials: false

      - name: Resolve version
        id: version
        env:
          REF_TYPE: ${{ github.ref_type }}
          REF_NAME: ${{ github.ref_name }}
        run: |
          csproj=src/FiscalApi.Cli/FiscalApi.Cli.csproj
          if [ "$(grep -c '<Version>' "$csproj")" -ne 1 ]; then
            echo "::error::$csproj debe declarar exactamente un <Version>."
            exit 1
          fi
          version=$(sed -nE 's|.*<Version>([^<]+)</Version>.*|\1|p' "$csproj")
          identifier='(0|[1-9][0-9]*|[0-9]*[a-zA-Z-][0-9a-zA-Z-]*)'
          semver="^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-${identifier}(\.${identifier})*)?(\+[0-9a-zA-Z-]+(\.[0-9a-zA-Z-]+)*)?$"
          if ! [[ "$version" =~ $semver ]]; then
            echo "::error::<Version> de $csproj ('$version') no es semántica (p. ej. 1.2.3 o 1.2.3-rc.1)."
            exit 1
          fi
          if [ "$REF_TYPE" = "tag" ] && [ "${REF_NAME#v}" != "$version" ]; then
            echo "::error::El tag $REF_NAME no coincide con <Version> $version de $csproj."
            exit 1
          fi
          without_build="${version%%+*}"
          if [[ "$without_build" == *-* ]]; then prerelease=true; else prerelease=false; fi
          {
            echo "version=$version"
            echo "tag=v$version"
            echo "prerelease=$prerelease"
          } >> "$GITHUB_OUTPUT"
          echo "Versión $version (prerelease: $prerelease)."

      - name: Ensure the tag does not exist yet
        if: github.ref_type != 'tag'
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: v${{ steps.version.outputs.version }}
        run: |
          if output=$(gh api "repos/$GITHUB_REPOSITORY/git/ref/tags/$TAG" --jq .ref 2>&1); then
            echo "::error::El tag $TAG ya existe. Sube <Version> en src/FiscalApi.Cli/FiscalApi.Cli.csproj antes de publicar."
            exit 1
          fi
          if [[ "$output" != *"HTTP 404"* ]]; then
            echo "::error::No se pudo comprobar si el tag $TAG existe: $output"
            exit 1
          fi
          echo "El tag $TAG no existe: el borrador lo creará sobre $GITHUB_SHA al publicarse."

  build:
    name: Build ${{ matrix.rid }}
    needs: version
    strategy:
      fail-fast: true
      matrix:
        include:
          - rid: win-x64
            os: windows-latest
            binary: fiscalapi.exe
            package: fiscalapi-win-x64.zip
          - rid: linux-x64
            os: ubuntu-latest
            binary: fiscalapi
            package: fiscalapi-linux-x64.tar.gz
          - rid: osx-arm64
            os: macos-latest
            binary: fiscalapi
            package: fiscalapi-osx-arm64.tar.gz
          - rid: osx-x64
            os: macos-26-intel
            binary: fiscalapi
            package: fiscalapi-osx-x64.tar.gz
    runs-on: ${{ matrix.os }}
    timeout-minutes: 30
    env:
      VERSION: ${{ needs.version.outputs.version }}
      RID: ${{ matrix.rid }}
      PUBLISH_DIR: artifacts/${{ matrix.rid }}
      BINARY: ${{ matrix.binary }}
      PACKAGE: ${{ matrix.package }}
      DOTNET_CLI_TELEMETRY_OPTOUT: "1"
      DOTNET_NOLOGO: "1"
      LINUX_BUILD_IMAGE: almalinux:8@sha256:8b469a3a78515e8a18ea8fc727e6a3679e1d0c5ba6f58d5b30be3d0d9b86cffe
    steps:
      - name: Checkout
        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
        with:
          persist-credentials: false

      - name: Set up .NET
        if: runner.os != 'Linux'
        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1
        with:
          global-json-file: global.json

      - name: Add the Visual Studio Installer folder to PATH
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          $installer = Join-Path ${env:ProgramFiles(x86)} 'Microsoft Visual Studio\Installer'
          $vswhere = Get-Command vswhere.exe -ErrorAction SilentlyContinue
          Write-Host "vswhere.exe antes del cambio: $(if ($vswhere) { $vswhere.Source } else { 'no está en PATH' })"
          Add-Content -Path $env:GITHUB_PATH -Value $installer

      - name: Credential store tests (Credential Manager / Keychain)
        if: runner.os != 'Linux'
        run: |
          test_command=(dotnet test FiscalApi.Cli.slnx -c Release
            --filter "FullyQualifiedName~CredentialStoreTests"
            --logger "trx;LogFileName=credential-store.trx" --results-directory TestResults)
          if [ "$RUNNER_OS" = "macOS" ]; then
            bash .github/scripts/with-test-keychain.sh "${test_command[@]}"
          else
            "${test_command[@]}"
          fi
          counters=$(grep -o '<Counters [^>]*>' TestResults/credential-store.trx)
          total=$(sed -E 's/.* total="([0-9]+)".*/\1/' <<< "$counters")
          passed=$(sed -E 's/.* passed="([0-9]+)".*/\1/' <<< "$counters")
          echo "CredentialStoreTests: $passed de $total pasaron."
          if [ "$total" -eq 0 ] || [ "$passed" -ne "$total" ]; then
            echo "::error::CredentialStoreTests debe correr y pasar completa en $RID ($passed de $total)."
            exit 1
          fi

      - name: Publish Native AOT (${{ matrix.rid }})
        run: |
          if [ "$RUNNER_OS" = "Linux" ]; then
            docker run --rm -v "$GITHUB_WORKSPACE:/src" -w /src "$LINUX_BUILD_IMAGE" \
              bash .github/scripts/publish-linux.sh "$VERSION" "$PUBLISH_DIR"
          else
            dotnet publish src/FiscalApi.Cli -c Release -r "$RID" -o "$PUBLISH_DIR"
          fi

      - name: Smoke test
        run: |
          actual=$("./$PUBLISH_DIR/$BINARY" --version | tr -d '\r')
          if [ "$actual" != "$VERSION" ]; then
            echo "::error::$BINARY --version devolvió '$actual' en $RID; se esperaba '$VERSION'."
            exit 1
          fi
          "./$PUBLISH_DIR/$BINARY" --help > /dev/null
          echo "$RID: fiscalapi $actual"

      - name: Package (zip)
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          New-Item -ItemType Directory -Force -Path dist | Out-Null
          Compress-Archive -Path "$env:PUBLISH_DIR/$env:BINARY" -DestinationPath "dist/$env:PACKAGE"
          $zip = [System.IO.Compression.ZipFile]::OpenRead((Resolve-Path "dist/$env:PACKAGE"))
          try { $entries = @($zip.Entries | ForEach-Object FullName) } finally { $zip.Dispose() }
          if ($entries.Count -ne 1 -or $entries[0] -ne $env:BINARY) {
            Write-Output "::error::$env:PACKAGE debe traer solo $env:BINARY; trae: $($entries -join ', ')."
            exit 1
          }

      - name: Package (tar.gz)
        if: runner.os != 'Windows'
        run: |
          mkdir -p dist
          COPYFILE_DISABLE=1 tar -czf "dist/$PACKAGE" -C "$PUBLISH_DIR" "$BINARY"
          tar -tzvf "dist/$PACKAGE"
          entries=$(tar -tzf "dist/$PACKAGE")
          if [ "$entries" != "$BINARY" ]; then
            echo "::error::$PACKAGE debe traer solo $BINARY; trae: $(tr '\n' ' ' <<< "$entries")."
            exit 1
          fi

      - name: Upload package
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        with:
          name: package-${{ matrix.rid }}
          path: dist/${{ matrix.package }}
          if-no-files-found: error
          retention-days: 7
          compression-level: 0

  release:
    name: Draft release
    needs: [version, build]
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: write
    env:
      VERSION: ${{ needs.version.outputs.version }}
      TAG: ${{ needs.version.outputs.tag }}
      PRERELEASE: ${{ needs.version.outputs.prerelease }}
    steps:
      - name: Download packages
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          pattern: package-*
          path: dist
          merge-multiple: true

      - name: Checksums
        working-directory: dist
        run: |
          expected=(fiscalapi-win-x64.zip fiscalapi-linux-x64.tar.gz fiscalapi-osx-arm64.tar.gz fiscalapi-osx-x64.tar.gz)
          for package in "${expected[@]}"; do
            if [ ! -f "$package" ]; then
              echo "::error::Falta $package."
              exit 1
            fi
          done
          if [ "$(find . -maxdepth 1 -type f | wc -l)" -ne "${#expected[@]}" ]; then
            echo "::error::dist trae archivos de más: $(ls)."
            exit 1
          fi
          sha256sum "${expected[@]}" > SHA256SUMS
          sha256sum -c SHA256SUMS
          cat SHA256SUMS

      - name: Create draft release
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
          REF_TYPE: ${{ github.ref_type }}
        run: |
          args=(--draft --title "fiscalapi $VERSION" --generate-notes)
          if [ "$REF_TYPE" = "tag" ]; then
            args+=(--verify-tag)
          else
            args+=(--target "$GITHUB_SHA")
          fi
          if [ "$PRERELEASE" = "true" ]; then
            args+=(--prerelease)
          fi
          gh release create "$TAG" "${args[@]}" dist/fiscalapi-* dist/SHA256SUMS
          gh release view "$TAG" --json isDraft,isPrerelease,assets --jq '{isDraft, isPrerelease, assets: [.assets[].name]}'