name: "Release: on merge"

permissions:
  contents: write

on:
  pull_request:
    types:
      - closed

defaults:
  run:
    shell: bash --noprofile --norc -euo pipefail {0}

jobs:
  tag_and_release:
    timeout-minutes: 10
    runs-on: ubuntu-latest
    if: github.event.pull_request.merged == true && contains(github.event.pull_request.labels.*.name, 'release')
    steps:
      - name: Check PR Author
        id: check_author
        env:
          PR_AUTHOR: ${{ github.event.pull_request.user.login }}
        run: |
          set -euo pipefail
          if [[ "$PR_AUTHOR" != "github-actions[bot]" ]]; then
            echo "PR author ($PR_AUTHOR) is not trusted. Exiting."
            exit 1
          fi

      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: main

      - name: Get version from PR title
        id: extract_version
        env:
          PR_TITLE: ${{ github.event.pull_request.title }}
        run: |
          set -euo pipefail
          VERSION=$(printf '%s' "$PR_TITLE" | sed -n 's/.*Release v\([0-9][0-9.]*\).*/\1/p')
          if [ -z "$VERSION" ]; then
            echo "No valid version found in PR title. Exiting."
            exit 1
          fi
          printf 'VERSION=%s\n' "$VERSION" >> "$GITHUB_ENV"

      - name: Push new tag
        run: |
          set -euo pipefail
          git config --global user.name 'Github Action Deploy'
          git config --global user.email 'github-action-deploy@twenty.com'
          git tag "v${{ env.VERSION }}"
          git push origin "v${{ env.VERSION }}"

      - uses: release-drafter/release-drafter@v5
        if: contains(github.event.pull_request.labels.*.name, 'create_release')
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          tag: v${{ env.VERSION }}