name: release

on:
  push:
    tags:
      - "v*"

concurrency:
  group: release-${{ github.ref_name }}
  cancel-in-progress: false

jobs:
  validate:
    runs-on: ubuntu-latest
    outputs:
      sha: ${{ steps.release.outputs.sha }}
      tag: ${{ steps.release.outputs.tag }}
      channel: ${{ steps.release.outputs.channel }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - id: release
        name: Validate tag shape and promotion branch
        run: |
          set -euo pipefail
          tag=${GITHUB_REF#refs/tags/}
          channel=$(python3 -c \
            'import sys; from bot_bottle.release_qualification import release_channel; print(release_channel(sys.argv[1]))' \
            "$tag")
          branch=$channel
          git fetch origin "$branch"
          sha=$(git rev-list -n 1 "$tag")
          git merge-base --is-ancestor "$sha" "origin/$branch" || {
            echo "$tag is not reachable from protected $branch" >&2
            exit 1
          }
          echo "sha=$sha" >> "$GITHUB_OUTPUT"
          echo "tag=$tag" >> "$GITHUB_OUTPUT"
          echo "channel=$channel" >> "$GITHUB_OUTPUT"

  qualify:
    needs: validate
    uses: ./.gitea/workflows/pre-release-test.yml
    with:
      ref: ${{ needs.validate.outputs.sha }}
    secrets:
      BOT_BOTTLE_INFRA_ARTIFACT_TOKEN: ${{ secrets.BOT_BOTTLE_INFRA_ARTIFACT_TOKEN }}

  artifacts:
    needs: [validate, qualify]
    uses: ./.gitea/workflows/publish-artifacts.yml
    with:
      ref: ${{ needs.validate.outputs.sha }}
    secrets:
      BOT_BOTTLE_RELEASE_TOKEN: ${{ secrets.BOT_BOTTLE_RELEASE_TOKEN }}
      BOT_BOTTLE_INFRA_ARTIFACT_TOKEN: ${{ secrets.BOT_BOTTLE_INFRA_ARTIFACT_TOKEN }}

  promote:
    needs: [validate, artifacts]
    runs-on: ubuntu-latest
    concurrency:
      group: release-channel-${{ needs.validate.outputs.channel }}
      cancel-in-progress: false
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ needs.validate.outputs.sha }}
      - name: Verify install from the published bundle
        env:
          BOT_BOTTLE_REF: ${{ needs.validate.outputs.sha }}
        run: |
          sh install.sh
          "$HOME/.local/bin/bot-bottle" --help
      - name: Publish release qualification and advance channel
        env:
          BOT_BOTTLE_RELEASE_TOKEN: ${{ secrets.BOT_BOTTLE_RELEASE_TOKEN }}
        run: |
          python3 scripts/publish_release_qualification.py \
            --tag '${{ needs.validate.outputs.tag }}' \
            --source-commit '${{ needs.validate.outputs.sha }}' \
            --workflow-run \
              "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}" \
            --qualified-at "$(date -u +%Y-%m-%dT%H:%M:%SZ)"
      - name: Create the Gitea release
        env:
          GITEA_TOKEN: ${{ secrets.BOT_BOTTLE_RELEASE_TOKEN }}
        run: |
          curl --fail-with-body --silent --show-error \
            -H "Authorization: token $GITEA_TOKEN" \
            -H "Content-Type: application/json" \
            -d "{\"tag_name\":\"${{ needs.validate.outputs.tag }}\",\"name\":\"${{ needs.validate.outputs.tag }}\",\"target_commitish\":\"${{ needs.validate.outputs.sha }}\"}" \
            "${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}/releases"