name: Release LinkLog

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:

env:
  IMAGE_NAME: git.kolkman.org/olaf/link-log

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - name: Check out release tag
        uses: actions/checkout@v4

      - name: Validate versions and signed XPI
        id: release
        run: |
          python3 scripts/release/validate_release.py
          version=$(python3 -c "import json; print(json.load(open('frontend/version.json'))['version'])")
          echo "version=$version" >> "$GITHUB_OUTPUT"
          if [ "${GITHUB_REF_NAME#v}" != "$version" ]; then
            echo "tag ${GITHUB_REF_NAME} does not match release version $version" >&2
            exit 1
          fi

      - name: Log in to Gitea container registry
        uses: docker/login-action@v3
        with:
          registry: git.kolkman.org
          username: ${{ secrets.REGISTRY_USERNAME }}
          password: ${{ secrets.REGISTRY_TOKEN }}

      - name: Build and publish Docker image
        uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: |
            ${{ env.IMAGE_NAME }}:${{ steps.release.outputs.version }}
            ${{ env.IMAGE_NAME }}:latest
          labels: |
            org.opencontainers.image.version=${{ steps.release.outputs.version }}
            org.opencontainers.image.source=https://git.kolkman.org/olaf/Link-Log

      - name: Create Gitea release
        id: gitea_release
        env:
          RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
          VERSION: ${{ steps.release.outputs.version }}
        run: |
          response_file=$(mktemp)
          response_status=$(curl --silent --show-error -o "$response_file" -w '%{http_code}' \
            -X POST \
            -H "Authorization: token $RELEASE_TOKEN" \
            -H 'Content-Type: application/json' \
            -d "{\"tag_name\":\"v$VERSION\",\"name\":\"LinkLog $VERSION\",\"draft\":false,\"prerelease\":false}" \
            https://git.kolkman.org/api/v1/repos/olaf/Link-Log/releases)
          if [ "$response_status" = 409 ]; then
            response_status=$(curl --silent --show-error -o "$response_file" -w '%{http_code}' \
              -H "Authorization: token $RELEASE_TOKEN" \
              "https://git.kolkman.org/api/v1/repos/olaf/Link-Log/releases/tags/v$VERSION")
          fi
          if [ "$response_status" -lt 200 ] || [ "$response_status" -ge 300 ]; then
            cat "$response_file" >&2
            exit 1
          fi
          response=$(cat "$response_file")
          rm -f "$response_file"
          release_id=$(printf '%s' "$response" | python3 -c 'import json, sys; print(json.load(sys.stdin)["id"])')
          test "$release_id" != null
          test "$release_id" != 0
          upload_url="https://git.kolkman.org/api/v1/repos/olaf/Link-Log/releases/$release_id/assets"
          echo "upload_url=$upload_url" >> "$GITHUB_OUTPUT"

      - name: Upload signed XPI and update manifest
        env:
          RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
          UPLOAD_URL: ${{ steps.gitea_release.outputs.upload_url }}
          VERSION: ${{ steps.release.outputs.version }}
        run: |
          response_status=$(curl --silent --show-error -o /tmp/linklog-xpi-upload-response -w '%{http_code}' \
            -X POST -H "Authorization: token $RELEASE_TOKEN" \
            -H 'Content-Type: application/x-xpinstall' \
            --data-binary "@XPI/signed/LinkLog-$VERSION.xpi" \
            "$UPLOAD_URL?name=LinkLog-$VERSION.xpi")
          if [ "$response_status" -lt 200 ] || [ "$response_status" -ge 300 ]; then
            cat /tmp/linklog-xpi-upload-response >&2
            exit 1
          fi
          response_status=$(curl --silent --show-error -o /tmp/linklog-updates-upload-response -w '%{http_code}' \
            -X POST -H "Authorization: token $RELEASE_TOKEN" \
            -H 'Content-Type: application/json' \
            --data-binary @webextension/updates.json \
            "$UPLOAD_URL?name=updates.json")
          if [ "$response_status" -lt 200 ] || [ "$response_status" -ge 300 ]; then
            cat /tmp/linklog-updates-upload-response >&2
            exit 1
          fi

      - name: Publish release links
        env:
          VERSION: ${{ steps.release.outputs.version }}
        run: |
          echo "Docker image: $IMAGE_NAME:$VERSION"
          echo "Signed XPI: https://git.kolkman.org/olaf/Link-Log/releases/download/v$VERSION/LinkLog-$VERSION.xpi"
          echo "Firefox update manifest: https://git.kolkman.org/olaf/Link-Log/raw/branch/main/webextension/updates.json"