name: Build and Release

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      tag:
        description: 'Tag name to release (e.g. v1.0.0)'
        required: true

jobs:
  build-and-publish:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      packages: write
      id-token: write

    steps:
      - uses: actions/checkout@v4

      - name: Setup .NET
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '10.0.x'

      - name: Extract version from tag
        id: version
        run: |
          TAG=${{ github.event.inputs.tag || github.ref_name }}
          echo "VERSION=${TAG#v}" >> $GITHUB_OUTPUT
          echo "TAG=$TAG" >> $GITHUB_OUTPUT

      - name: Build
        run: dotnet build SecretSecurity/SecretSecurity.csproj --configuration Release

      - name: Pack NuGet tool
        run: >
          dotnet pack SecretSecurity/SecretSecurity.csproj
          --configuration Release
          --no-build
          -p:Version=${{ steps.version.outputs.VERSION }}
          --output ./nupkg

      - name: NuGet login (OIDC trusted publishing)
        uses: NuGet/login@v1
        id: nuget-login
        with:
          user: ${{ secrets.NUGET_USER }}

      - name: Push to NuGet.org
        run: >
          dotnet nuget push ./nupkg/*.nupkg
          --api-key ${{ steps.nuget-login.outputs.NUGET_API_KEY }}
          --source https://api.nuget.org/v3/index.json

      - name: Push to GitHub Packages
        run: >
          dotnet nuget push ./nupkg/*.nupkg
          --api-key ${{ secrets.GITHUB_TOKEN }}
          --source https://nuget.pkg.github.com/${{ github.repository_owner }}/index.json

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ steps.version.outputs.TAG }}
          files: ./nupkg/*.nupkg
          generate_release_notes: true