name: release

# Plugin-agnostic: owner, repo, host, package name and version come from the `github` context
# and composer.json. shopware-cli runs from its official Docker image, intentionally unpinned (latest).
# RELEASE_TOKEN is the single token used for releases, assets and the Composer registry.

on:
  push:
    branches: [main]

permissions:
  contents: write
  packages: write

# Never run two releases at once; a second push waits instead of racing on the tag.
concurrency:
  group: release
  cancel-in-progress: false

jobs:
  release:
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/shopware/shopware-cli:latest
    steps:
      - name: Ensure helper tools (jq, curl, unzip, git)
        run: |
          command -v jq >/dev/null && command -v curl >/dev/null && command -v unzip >/dev/null && command -v git >/dev/null && exit 0
          (apt-get update -q && apt-get install -y -q --no-install-recommends jq curl unzip git) || apk add --no-cache jq curl unzip git

      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          token: ${{ secrets.RELEASE_TOKEN }}

      - name: Determine version and guard against re-release
        id: meta
        run: |
          set -e
          VERSION=$(jq -r .version composer.json)
          PACKAGE_NAME=$(jq -r .name composer.json)
          REPO_NAME="${GITHUB_REPOSITORY#*/}"
          TAG="v${VERSION}"
          {
            echo "version=${VERSION}"
            echo "package_name=${PACKAGE_NAME}"
            echo "tag=${TAG}"
            echo "zip=${REPO_NAME}-${TAG}.zip"
          } >> "$GITHUB_OUTPUT"
          if git ls-remote --tags origin "refs/tags/${TAG}" | grep -q "${TAG}"; then
            echo "skip=true" >> "$GITHUB_OUTPUT"
            echo "Tag ${TAG} already exists, nothing to release."
          else
            echo "skip=false" >> "$GITHUB_OUTPUT"
          fi

      # Reuse the zip the PR workflow already built and tested for this exact tree.
      - name: Tree hash of this commit
        if: steps.meta.outputs.skip == 'false'
        id: tree
        run: echo "hash=$(git rev-parse "${GITHUB_SHA}^{tree}")" >> "$GITHUB_OUTPUT"

      - name: Restore the tested zip from the PR run
        if: steps.meta.outputs.skip == 'false'
        id: prebuilt
        uses: actions/cache/restore@v4
        with:
          path: .build/package.zip
          key: plugin-zip-${{ steps.tree.outputs.hash }}

      - name: Name the prebuilt zip
        if: steps.meta.outputs.skip == 'false' && steps.prebuilt.outputs.cache-hit == 'true'
        run: mv .build/package.zip ".build/${{ steps.meta.outputs.zip }}"

      # Packages only on a cache miss; always validates and asserts what ships (guards a bad cache entry).
      - uses: ./.gitea/actions/package
        if: steps.meta.outputs.skip == 'false'
        with:
          filename: ${{ steps.meta.outputs.zip }}
          build: ${{ steps.prebuilt.outputs.cache-hit != 'true' }}

      - name: Extract changelog section
        if: steps.meta.outputs.skip == 'false'
        run: |
          awk -v ver="${{ steps.meta.outputs.version }}" '
            BEGIN { found=0 }
            /^## \[/ {
              if (found) exit
              if ($0 ~ "\\[" ver "\\]") { found=1; next }
            }
            found { print }
          ' CHANGELOG.md > release-notes.md
          cat release-notes.md

      - name: Create Gitea release (creates the tag) and upload the zip
        if: steps.meta.outputs.skip == 'false'
        env:
          TOKEN: ${{ secrets.RELEASE_TOKEN }}
        run: |
          set -e
          API="${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}"
          BODY=$(jq -n --arg tag "${{ steps.meta.outputs.tag }}" --arg sha "$GITHUB_SHA" --rawfile notes release-notes.md \
            '{tag_name:$tag, target_commitish:$sha, name:$tag, body:$notes}')
          RELEASE_ID=$(curl -sf -H "Authorization: token ${TOKEN}" -H "Content-Type: application/json" -d "$BODY" "${API}/releases" | jq -r .id)
          echo "release id: ${RELEASE_ID}"
          curl -sf -H "Authorization: token ${TOKEN}" \
            -F "attachment=@.build/${{ steps.meta.outputs.zip }}" \
            "${API}/releases/${RELEASE_ID}/assets?name=${{ steps.meta.outputs.zip }}" > /dev/null

      - name: Publish the same zip to the Composer registry
        if: steps.meta.outputs.skip == 'false'
        run: |
          STATUS=$(curl -s -o /tmp/composer-publish.log -w "%{http_code}" \
            -u "${GITHUB_REPOSITORY_OWNER}:${{ secrets.RELEASE_TOKEN }}" \
            -T ".build/${{ steps.meta.outputs.zip }}" \
            "${GITHUB_SERVER_URL}/api/packages/${GITHUB_REPOSITORY_OWNER}/composer")
          cat /tmp/composer-publish.log
          if [ "$STATUS" != "201" ] && [ "$STATUS" != "409" ]; then
            echo "Unexpected HTTP status $STATUS publishing to the Composer registry"
            exit 1
          fi

      - name: Link Composer package to this repository
        if: steps.meta.outputs.skip == 'false'
        run: |
          ENCODED_NAME=$(printf '%s' "${{ steps.meta.outputs.package_name }}" | sed 's#/#%2F#g')
          STATUS=$(curl -s -o /dev/null -w "%{http_code}" -u "${GITHUB_REPOSITORY_OWNER}:${{ secrets.RELEASE_TOKEN }}" -X POST \
            "${GITHUB_SERVER_URL}/api/v1/packages/${GITHUB_REPOSITORY_OWNER}/composer/${ENCODED_NAME}/-/link/${GITHUB_REPOSITORY#*/}")
          echo "link status: $STATUS"
          if [ "$STATUS" != "201" ] && [ "$STATUS" != "400" ]; then
            echo "::warning::Unexpected status linking the Composer package to this repository (HTTP $STATUS) - not fatal, release already published"
          fi