name: Release candidate

on:
  workflow_dispatch:
    inputs:
      js-sdk:
        description: 'Release JS SDK'
        required: false
        default: false
        type: boolean
      python-sdk:
        description: 'Release Python SDK'
        required: false
        default: false
        type: boolean
      cli:
        description: 'Release CLI'
        required: false
        default: false
        type: boolean
      tag:
        description: 'Dist-tag (e.g. rc, beta, snapshot)'
        required: false
        default: 'rc'
        type: string
      preid:
        description: 'Prerelease identifier (defaults to branch name)'
        required: false
        default: ''
        type: string
      skip-tests:
        description: 'Skip tests'
        required: false
        default: false
        type: boolean

# Shared literal group so production and candidate releases on the same ref serialize.
concurrency: release-${{ github.ref }}

permissions:
  id-token: write
  contents: write

jobs:
  rc-validate:
    name: Validate RC inputs
    runs-on: ubuntu-latest
    outputs:
      preid: ${{ steps.preid.outputs.preid }}
      tag: ${{ steps.tag.outputs.tag }}
    steps:
      - name: Sanitize tag
        id: tag
        env:
          RAW_TAG: ${{ github.event.inputs.tag }}
        run: |
          SAFE_TAG="$(echo "$RAW_TAG" | sed 's/[^0-9A-Za-z-]/-/g')"
          echo "tag=$SAFE_TAG" >> "$GITHUB_OUTPUT"

      - name: Block production tags
        run: |
          if [ "${{ steps.tag.outputs.tag }}" = "latest" ]; then
            echo "::error::Publishing with the 'latest' tag is not allowed for candidates. Use the 'Release' workflow instead."
            exit 1
          fi

      - name: Sanitize preid
        id: preid
        env:
          RAW_PREID: ${{ github.event.inputs.preid || github.ref_name }}
        run: |
          echo "preid=$(echo "$RAW_PREID" | sed 's/[^0-9A-Za-z-]/-/g')" >> "$GITHUB_OUTPUT"

  rc-python-tests:
    name: RC Python Tests
    needs: [rc-validate]
    if: github.event.inputs.python-sdk == 'true' && github.event.inputs.skip-tests != 'true'
    uses: ./.github/workflows/python_sdk_tests.yml
    secrets: inherit

  rc-js-tests:
    name: RC JS Tests
    needs: [rc-validate]
    if: github.event.inputs.js-sdk == 'true' && github.event.inputs.skip-tests != 'true'
    uses: ./.github/workflows/js_sdk_tests.yml
    secrets: inherit

  rc-cli-tests:
    name: RC CLI Tests
    needs: [rc-validate]
    if: github.event.inputs.cli == 'true' && github.event.inputs.skip-tests != 'true'
    uses: ./.github/workflows/cli_tests.yml
    secrets: inherit

  rc-publish:
    name: Publish RC
    needs: [rc-validate, rc-python-tests, rc-js-tests, rc-cli-tests]
    if: (!cancelled()) && !contains(needs.*.result, 'failure') && needs.rc-validate.result == 'success'
    uses: ./.github/workflows/publish_candidates.yml
    with:
      js-sdk: ${{ github.event.inputs.js-sdk == 'true' }}
      python-sdk: ${{ github.event.inputs.python-sdk == 'true' }}
      cli: ${{ github.event.inputs.cli == 'true' }}
      tag: ${{ needs.rc-validate.outputs.tag }}
      preid: ${{ needs.rc-validate.outputs.preid }}
    secrets: inherit