name: package

on:
  push:
    branches: [main, code-preview]
    tags: ["v*"]
  pull_request:

jobs:
  wheel:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
          cache-dependency-path: interface/web/package-lock.json

      - name: Build and test web UI
        working-directory: interface/web
        run: |
          npm ci
          npm run lint
          npm test
          npm run build

      - uses: actions/setup-python@v5
        with:
          python-version: "3.13"
          cache: pip

      - name: Test Python runtime
        run: |
          python -m pip install -e ".[dev]"
          python -m pytest -q tests management
          bash -n scripts/install-termux.sh

      - name: Build wheel and sdist
        run: |
          python -m build
          python -m twine check dist/*

      - name: Verify clean wheel install
        run: |
          python -m venv "$RUNNER_TEMP/nexus-wheel"
          "$RUNNER_TEMP/nexus-wheel/bin/python" -m pip install dist/*.whl
          cd "$RUNNER_TEMP"
          export NEXUS_HOME="$RUNNER_TEMP/nexus-home"
          export NEXUS_CONFIG_DIR="$RUNNER_TEMP/nexus-config"
          "$RUNNER_TEMP/nexus-wheel/bin/nexus" init --json
          "$RUNNER_TEMP/nexus-wheel/bin/nexus" doctor --json
          "$RUNNER_TEMP/nexus-wheel/bin/python" -c "from synapse.main import sio_app; assert sio_app"

      - uses: actions/upload-artifact@v4
        with:
          name: nexusos-python-dist
          path: dist/*

      - name: Publish tagged release to PyPI
        if: startsWith(gitea.ref, 'refs/tags/v')
        env:
          TWINE_USERNAME: __token__
          TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
        run: python -m twine upload --non-interactive dist/*