name: Build and Sign Extension

on:
  push:
    tags:
      - 'v*'

jobs:
  build-sign-release:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: github.com/actions/checkout@v4

      - name: Setup Node.js
        uses: github.com/actions/setup-node@v4
        with:
          node-version: '20'

      - name: Install Mozilla web-ext CLI
        run: npm install -g web-ext

      - name: Build and Sign with Mozilla
        id: sign_extension
        # web-ext will automatically zip the directory, upload it to Mozilla, 
        # wait for the cryptographic signature, and download the resulting .xpi
        run: |
          web-ext sign \
            --source-dir . \
            --channel unlisted \
            --api-key ${{ secrets.AMO_JWT_ISSUER }} \
            --api-secret ${{ secrets.AMO_JWT_SECRET }} \
            --artifacts-dir ./web-ext-artifacts \
            --ignore-files ".forgejo" ".git" "updates.json" "*.md"

      - name: Upload signed XPI to Forgejo Release
        uses: github.com/softprops/action-gh-release@v2
        with:
          # web-ext puts the downloaded file in the artifacts directory
          files: ./web-ext-artifacts/*.xpi
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}