name: sign and upload release files

on:
  workflow_call:
    inputs:
      release_tag:
        required: true
        type: string
      artifact_name:
        required: true
        type: string
      file_pattern:
        required: false
        type: string
        default: '**/*'
      content_type:
        required: false
        type: string
        default: application/octet-stream
    secrets:
      GPG_PRIVATE_KEY:
        required: true

permissions:
  contents: write
  actions: read

jobs:
  upload:
    runs-on: ubuntu-26.04
    steps:
    - name: Download release artifact
      uses: actions/download-artifact@v8
      with:
        name: ${{ inputs.artifact_name }}
        path: dist

    - name: Import GPG private key
      shell: bash
      env:
        GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
      run: |
        set -euo pipefail
        install -m 700 -d ~/.gnupg
        printf '%s' "$GPG_PRIVATE_KEY" | gpg --batch --import

    - name: Sign release files
      shell: bash
      run: |
        set -euo pipefail
        cd dist
        shopt -s globstar nullglob
        files=( ${{ inputs.file_pattern }} )
        (( ${#files[@]} )) || { echo "No files matched: ${{ inputs.file_pattern }}"; exit 1; }
        for f in "${files[@]}"; do
          [[ -f "$f" ]] || continue
          gpg --batch --yes --armor --detach-sign --output "$f.sig" "$f"
        done

    - name: Upload release files
      uses: svenstaro/upload-release-action@v2
      with:
        file: dist/${{ inputs.file_pattern }}
        tag: ${{ inputs.release_tag }}
        file_glob: true
        prerelease: true
        overwrite: true

    - name: Upload release signatures
      uses: svenstaro/upload-release-action@v2
      with:
        file: dist/${{ inputs.file_pattern }}.sig
        tag: ${{ inputs.release_tag }}
        file_glob: true
        prerelease: true
        overwrite: true