name: Release

on:
  push:
    tags:
      - 'v*'

permissions:
  contents: write

jobs:
  release:
    name: Build & publish plugin zip
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Build plugin zip
        working-directory: ${{ github.workspace }}
        run: |
          set -euo pipefail
          VERSION="${GITHUB_REF_NAME#v}"
          OUT="dist/projects-portfolio-v${VERSION}.zip"

          rm -rf dist
          mkdir -p dist

          # Use Python's stdlib zipfile module — guaranteed to be on ubuntu-latest.
          python3 - "$OUT" <<'PYEOF'
          import os
          import sys
          import zipfile

          out_path = sys.argv[1]
          allowed = [
              "projects-portfolio.php",
              "README.md",
              "LICENSE",
              "admin",
              "assets",
              "includes",
              "languages",
              "templates",
          ]

          with zipfile.ZipFile(out_path, "w", compression=zipfile.ZIP_DEFLATED) as zf:
              for entry in allowed:
                  if os.path.isdir(entry):
                      for root, _, files in os.walk(entry):
                          for name in files:
                              abs_path = os.path.join(root, name)
                              arcname = os.path.join("projects-portfolio", abs_path)
                              zf.write(abs_path, arcname)
                  elif os.path.isfile(entry):
                      zf.write(entry, os.path.join("projects-portfolio", entry))
                  else:
                      sys.exit(f"Allowlisted path missing: {entry}")
          PYEOF

          echo "Built $OUT"
          python3 -c "import zipfile; zf=zipfile.ZipFile('$OUT'); print('\n'.join(zf.namelist()))"

      - name: Upload artifact
        uses: actions/upload-artifact@v3
        with:
          name: projects-portfolio-${{ github.ref_name }}
          path: dist/projects-portfolio-*.zip
          if-no-files-found: error

      - name: Create GitHub release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          gh release create "$GITHUB_REF_NAME" \
            --title "$GITHUB_REF_NAME" \
            --generate-notes \
            dist/projects-portfolio-*.zip