name: release

on:
  push:
    tags:
      - '*'
  workflow_dispatch:
    inputs:
      tag:
        description: Existing version tag
        required: true

jobs:
  macos-arm64:
    runs-on: ${{ vars.MACOS_ARM64_RUNNER_LABEL }}
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
      - name: Validate and package macOS archive
        env:
          RELEASE_TAG: ${{ github.ref_name || inputs.tag }}
        run: |
          VERSION=$(grep '^version = ' Cargo.toml | head -1 | cut -d'"' -f2)
          test "$RELEASE_TAG" = "$VERSION" || test "$RELEASE_TAG" = "v$VERSION"
          test "$(rustc -vV | awk '/host:/ {print $2}')" = "aarch64-apple-darwin"
          cargo metadata --locked --no-deps --format-version 1
          cargo fmt --check
          cargo clippy --locked --workspace --all-targets -- -D warnings
          cargo test --locked --workspace
          cargo build --locked --release
          NAME="azure-database-tui-$RELEASE_TAG-macos-arm64.tar.gz"
          mkdir -p "package/azure-database-tui-$RELEASE_TAG"
          cp target/release/azure-database-tui "package/azure-database-tui-$RELEASE_TAG/"
          cp README.md docs/security.md docs/operations.md docs/release.md "package/azure-database-tui-$RELEASE_TAG/"
          tar -czf "$NAME" -C package "azure-database-tui-$RELEASE_TAG"
          shasum -a 256 "$NAME" > "$NAME.sha256"
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
        with:
          name: macos-release
          path: azure-database-tui-*-macos-arm64.tar.gz*
  windows-x86_64:
    runs-on: ${{ vars.WINDOWS_X86_64_RUNNER_LABEL }}
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
      - name: Validate and package Windows archive
        shell: pwsh
        env:
          RELEASE_TAG: ${{ github.ref_name || inputs.tag }}
        run: |
          $version = ((Get-Content Cargo.toml | Select-String '^version = ').ToString().Split('"')[1])
          if ($env:RELEASE_TAG -ne $version -and $env:RELEASE_TAG -ne "v$version") { throw 'Tag does not match package version' }
          if ((rustc -vV | Select-String '^host:').ToString().Split(': ')[1] -ne 'x86_64-pc-windows-msvc') { throw 'Unexpected Rust host target' }
          cargo metadata --locked --no-deps --format-version 1
          cargo fmt --check
          cargo clippy --locked --workspace --all-targets -- -D warnings
          cargo test --locked --workspace
          cargo build --locked --release
          $name = "azure-database-tui-$env:RELEASE_TAG-windows-x86_64.zip"
          $root = "package/azure-database-tui-$env:RELEASE_TAG"
          New-Item -ItemType Directory -Force -Path $root | Out-Null
          Copy-Item target/release/azure-database-tui.exe $root/
          Copy-Item README.md,docs/security.md,docs/operations.md,docs/release.md $root/
          Compress-Archive -Path $root -DestinationPath $name
          (Get-FileHash $name -Algorithm SHA256).Hash.ToLower() + "  " + $name | Out-File "$name.sha256" -Encoding ascii
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
        with:
          name: windows-release
          path: azure-database-tui-*-windows-x86_64.zip*
  publish:
    needs: [macos-arm64, windows-x86_64]
    runs-on: ${{ vars.MACOS_ARM64_RUNNER_LABEL }}
    env:
      RELEASE_TAG: ${{ github.ref_name || inputs.tag }}
      GITEA_API_URL: ${{ vars.GITEA_API_URL }}
      GITEA_REPOSITORY: ${{ vars.GITEA_REPOSITORY }}
      GITEA_RELEASE_TOKEN: ${{ secrets.GITEA_RELEASE_TOKEN }}
    steps:
      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
        with:
          path: release-assets
      - name: Publish completed draft release
        shell: bash
        run: |
          set -euo pipefail
          test -n "$GITEA_API_URL"; test -n "$GITEA_REPOSITORY"; test -n "$GITEA_RELEASE_TOKEN"
          files=(release-assets/macos-release/* release-assets/windows-release/*)
          test ${#files[@]} -eq 4
          for file in "${files[@]}"; do test -s "$file"; done
          api="$GITEA_API_URL/repos/$GITEA_REPOSITORY/releases/tags/$RELEASE_TAG"
          response=$(curl --silent --show-error --fail -H "Authorization: token $GITEA_RELEASE_TOKEN" "$api" || true)
          if test -z "$response"; then
            response=$(curl --silent --show-error --fail -X POST -H "Authorization: token $GITEA_RELEASE_TOKEN" -H "Content-Type: application/json" -d "{\"tag_name\":\"$RELEASE_TAG\",\"name\":\"$RELEASE_TAG\",\"draft\":true}" "$GITEA_API_URL/repos/$GITEA_REPOSITORY/releases")
          fi
          release_id=$(printf '%s' "$response" | python3 -c 'import json,sys; print(json.load(sys.stdin)["id"])')
          for file in "${files[@]}"; do curl --silent --show-error --fail -X POST -H "Authorization: token $GITEA_RELEASE_TOKEN" -F "attachment=@$file" "$GITEA_API_URL/repos/$GITEA_REPOSITORY/releases/$release_id/assets"; done
          curl --silent --show-error --fail -X PATCH -H "Authorization: token $GITEA_RELEASE_TOKEN" -H "Content-Type: application/json" -d '{"draft":false}' "$GITEA_API_URL/repos/$GITEA_REPOSITORY/releases/$release_id"