name: Build & Release Firefox Addon

on:
  push:
    tags:
      - "v*"
    branches:
      - dev

jobs:
  build:
    runs-on: ubuntu-latest
    env:
      WEB_EXT_IGNORE_FILES: scripts/**

    steps:
      - uses: actions/checkout@v4

      - name: Install deps
        run: npm install -g web-ext

      - name: Lint
        run: web-ext lint

      # Beta tag (v*-beta) → Sign as unlisted on AMO, attach signed XPI to GitHub Prerelease
      # Firefox blocks all unsigned XPIs, even for self-hosted installs — unlisted signing is required
      - name: Sign XPI via AMO (unlisted, beta)
        if: contains(github.ref_name, '-beta')
        run: |
          web-ext sign \
            --api-key ${{ secrets.FIREFOX_API_KEY }} \
            --api-secret ${{ secrets.FIREFOX_API_SECRET }} \
            --source-dir . \
            --artifacts-dir web-ext-artifacts \
            --channel unlisted

      - name: Get signed XPI path (beta)
        if: contains(github.ref_name, '-beta')
        id: xpi
        run: |
          FILE=$(ls web-ext-artifacts/*.xpi | head -n 1)
          XPI="web-ext-artifacts/speeder-${{ github.ref_name }}.xpi"
          mv "$FILE" "$XPI"
          echo "file=$XPI" >> $GITHUB_OUTPUT

      - name: Create GitHub Prerelease (beta)
        if: contains(github.ref_name, '-beta')
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ github.ref_name }}
          name: ${{ github.ref_name }}
          files: ${{ steps.xpi.outputs.file }}
          prerelease: true
          body: |
            Beta build — signed for self-hosted manual installation.

            ### Installation Instructions
            1. Click the `.xpi` file below
            2. Click "Continue to Installation"
            3. Click "Add"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      # Stable tag (v* without -beta) → Sign & submit to public AMO listing
      - name: Sign & Submit to AMO (stable)
        if:
          startsWith(github.ref, 'refs/tags/') && !contains(github.ref_name,
          '-beta')
        run: |
          web-ext sign \
            --api-key ${{ secrets.FIREFOX_API_KEY }} \
            --api-secret ${{ secrets.FIREFOX_API_SECRET }} \
            --source-dir . \
            --artifacts-dir web-ext-artifacts \
            --channel listed