name: Publish

on:
  release:
    # We'll run this workflow when a new GitHub release is created
    types: [released]

permissions:
  contents: read

jobs:
  test:
    uses: ./.github/workflows/test.yml

  publish:
    needs: test
    name: Publish Production
    environment: production
    # MUST be macOS: Kotlin/Native Apple targets (iosArm64/iosX64/iosSimulatorArm64) can only be
    # built on a macOS host. On a Linux runner those tasks are silently skipped, so the iOS klibs
    # never get uploaded (the build still goes green) — exactly what happened for 3.1.5–4.1.0.
    runs-on: macos-latest
    steps:
      - name: Check out code
        uses: actions/checkout@v4
      - name: Set up JDK 21
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: '21'
      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@v4

        # Uploads & stages the release on Central Portal. The final "Publish"
        # step is manual there, because build.gradle.kts sets
        # publishToMavenCentral(automaticRelease = false).
      - name: Publish to MavenCentral
        run: ./gradlew publishToMavenCentral
        env:
          ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
          ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
          ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ secrets.SIGNING_KEY }}
          ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.SIGNING_PASSWORD }}