# CI for @punktfunk/plugin-rom-manager (Gitea Actions). Mirrors the main repo's sdk-publish.yml:
# ubuntu-24.04 runner + the oven/bun:1 container, auth via the shared REGISTRY_TOKEN secret.
# Installs resolve @punktfunk/* + @unom/* (the SPA's design system) from the Gitea registry via the
# bunfig scope maps; `effect` comes from npm. Publish runs on a `v*` tag.
name: CI

on:
  push:
    branches: [main]
    tags: ['v*']
  pull_request:
  workflow_dispatch:

jobs:
  build:
    runs-on: ubuntu-24.04
    container:
      image: oven/bun:1
    timeout-minutes: 15
    steps:
      # oven/bun's slim base ships neither git nor a CA bundle — actions/checkout's HTTPS fetch needs both.
      - name: Install git + CA certs
        run: apt-get update && apt-get install -y --no-install-recommends ca-certificates git nodejs
      - uses: actions/checkout@v4
      - name: Registry auth
        env:
          TOKEN: ${{ secrets.REGISTRY_TOKEN }}
        run: |
          test -n "$TOKEN" || { echo "REGISTRY_TOKEN secret is empty"; exit 1; }
          printf '//git.unom.io/api/packages/unom/npm/:_authToken=%s\n' "$TOKEN" > "$HOME/.npmrc"
      - name: Install
        run: bun install --frozen-lockfile
      - name: Lint & format
        run: bunx biome check
      - name: Typecheck (backend)
        run: bunx tsc --noEmit
      - name: Test (engine)
        run: bun test
      - name: Build backend + SPA
        run: bun run build:all
      - name: Typecheck (UI)
        working-directory: ui
        run: bunx tsc --noEmit
      - name: Sanity — plugin default export is a valid PluginDef
        run: |
          bun -e 'import p from "./dist/index.js"; const d = p.default; if (d?.name !== "rom-manager" || typeof d?.main !== "function") { console.error("bad default export", d); process.exit(1); } console.log("ok:", d.name)'

  publish:
    needs: build
    if: startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-24.04
    container:
      image: oven/bun:1
    timeout-minutes: 15
    steps:
      - name: Install git + CA certs
        run: apt-get update && apt-get install -y --no-install-recommends ca-certificates git nodejs
      - uses: actions/checkout@v4
      - name: Registry auth
        env:
          TOKEN: ${{ secrets.REGISTRY_TOKEN }}
        run: |
          test -n "$TOKEN" || { echo "REGISTRY_TOKEN secret is empty"; exit 1; }
          printf '//git.unom.io/api/packages/unom/npm/:_authToken=%s\n' "$TOKEN" > "$HOME/.npmrc"
      - name: Install
        run: bun install --frozen-lockfile
      - name: Tag matches package version
        run: |
          TAG="${GITHUB_REF_NAME#v}"
          PKG="$(node -p "require('./package.json').version")"
          test "$TAG" = "$PKG" || { echo "tag $GITHUB_REF_NAME != package version $PKG"; exit 1; }
      - name: Publish (prepublishOnly builds backend + SPA)
        run: bun publish