name: Release

on:
    push:
        tags:
            - "**"

# Repository/owner Actions settings must allow code: read and releases: write.
# Release attachments must be enabled on the Gitea instance.
permissions:
    code: read
    releases: write

jobs:
    release:
        runs-on: ubuntu-latest
        steps:
            - name: Checkout tag
              uses: https://github.com/actions/checkout@v4
              with:
                  github-server-url: ${{ gitea.server_url }}
                  token: ${{ secrets.GITEA_TOKEN }}
                  persist-credentials: false
            - name: Install Bun
              uses: https://github.com/oven-sh/setup-bun@v2
              with:
                  bun-version: "1.4.2"
            - name: Verify and build
              run: |
                  bun install --frozen-lockfile
                  bun run check
                  bun run lint
                  bun run format:check
                  bun run test
                  bun run build
            - name: Pack distributable
              run: |
                  bun pm pack --filename stanp-opencode.tgz
                  sha256sum stanp-opencode.tgz > stanp-opencode.tgz.sha256
            - name: Publish Gitea release
              env:
                  GITEA_SERVER_URL: ${{ gitea.server_url }}
                  GITEA_REPOSITORY: ${{ gitea.repository }}
                  GITEA_TAG: ${{ gitea.ref_name }}
                  GITEA_COMMIT: ${{ gitea.sha }}
                  GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
              shell: bash
              run: |
                  set -euo pipefail
                  : "${GITEA_TOKEN:?Missing Gitea repository token}"
                  api="${GITEA_SERVER_URL%/}/api/v1/repos/${GITEA_REPOSITORY}/releases"
                  payload=$(jq -n --arg tag "$GITEA_TAG" --arg commit "$GITEA_COMMIT" \
                      '{tag_name: $tag, name: $tag, target_commitish: $commit, draft: true}')
                  response=$(mktemp)
                  trap 'rm -f "$response"' EXIT
                  status=$(curl --silent --show-error --output "$response" --write-out '%{http_code}' \
                      -H "Authorization: token $GITEA_TOKEN" \
                      -H 'Content-Type: application/json' \
                      --data "$payload" "$api")
                  case "$status" in
                      201) release=$(cat "$response") ;;
                      409)
                          tag=$(jq -rn --arg tag "$GITEA_TAG" '$tag | @uri')
                          if ! release=$(curl --fail-with-body --silent --show-error \
                              -H "Authorization: token $GITEA_TOKEN" "$api/tags/$tag"); then
                              printf '%s\n' "$release" >&2
                              exit 1
                          fi
                          ;;
                      *)
                          cat "$response" >&2
                          exit 1
                          ;;
                  esac
                  id=$(jq -er '.id | select(type == "number" and . > 0)' <<< "$release")
                  for asset in stanp-opencode.tgz stanp-opencode.tgz.sha256; do
                      asset_ids=$(jq -r --arg name "$asset" '.assets[]? | select(.name == $name) | .id' <<< "$release")
                      for asset_id in $asset_ids; do
                          curl --fail-with-body --silent --show-error --request DELETE \
                              -H "Authorization: token $GITEA_TOKEN" "$api/$id/assets/$asset_id"
                      done
                      curl --fail-with-body --silent --show-error \
                          -H "Authorization: token $GITEA_TOKEN" \
                          --form "attachment=@$asset" "$api/$id/assets"
                  done
                  curl --fail-with-body --silent --show-error --request PATCH \
                      -H "Authorization: token $GITEA_TOKEN" \
                      -H 'Content-Type: application/json' \
                      --data '{"draft":false}' "$api/$id"