name: Release

on:
  push:
    tags:
      - 'v*'

jobs:
  release:
    runs-on: ubuntu-latest
    container:
      image: rust:bookworm
      volumes:
        - /opt/runner/keys:/keys:ro

    steps:
      - name: Install tools
        run: |
          apt-get update
          apt-get install -y dpkg-dev git curl openssh-client

      - name: Setup SSH
        run: |
          test -r /keys/forgejo_runner || { echo "Deploy key /keys/forgejo_runner chybi"; exit 1; }
          install -m 600 /keys/forgejo_runner /tmp/forgejo_runner
          echo "GIT_SSH_COMMAND=ssh -p 554 -i /tmp/forgejo_runner -o IdentitiesOnly=yes -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR" >> "$GITHUB_ENV"

      - name: Checkout source
        run: |
          git clone ssh://git@git-ssh.janvete.com:554/seth/lines.git src
          cd src
          git checkout "${{ github.ref_name }}"

      - name: Build Linux release binary and .deb
        working-directory: src
        run: |
          VERSION=${{ github.ref_name }}
          VER=${VERSION#v}
          mkdir -p dist

          cargo build --release

          # .deb package
          DEB_DIR="lines_${VER}_amd64"
          mkdir -p "${DEB_DIR}/DEBIAN" "${DEB_DIR}/usr/bin"
          cp target/release/lines "${DEB_DIR}/usr/bin/lines"
          chmod 755 "${DEB_DIR}/usr/bin/lines"

          cat > "${DEB_DIR}/DEBIAN/control" << CONTROL
          Package: lines
          Version: ${VER}
          Section: utils
          Priority: optional
          Architecture: amd64
          Maintainer: janvete <jan.vete@example.com>
          Description: TUI for running frequently used commands from markdown files
          CONTROL

          dpkg-deb --build "${DEB_DIR}" "dist/${DEB_DIR}.deb"

          # Linux tarball
          STAGING=$(mktemp -d)
          cp target/release/lines "${STAGING}/lines"
          tar -czf "dist/lines-${VERSION}-linux-amd64.tar.gz" -C "${STAGING}" lines
          rm -rf "${STAGING}"

      - name: Print checksums
        working-directory: src
        run: |
          echo "=== SHA256 checksums ==="
          sha256sum dist/*

      - name: Create Forgejo Release
        working-directory: src
        env:
          FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
          FORGEJO_URL: https://git.janvete.com
        run: |
          VERSION=${{ github.ref_name }}
          API="${FORGEJO_URL}/api/v1/repos/seth/lines"

          RELEASE_JSON=$(curl -sS -H "Authorization: token ${FORGEJO_TOKEN}" \
            -H "Content-Type: application/json" \
            -X POST \
            -d "{\"tag_name\":\"${VERSION}\",\"name\":\"${VERSION}\",\"draft\":false,\"prerelease\":false}" \
            "${API}/releases")

          echo "Create release response: ${RELEASE_JSON}"
          RELEASE_ID=$(echo "${RELEASE_JSON}" | grep -o '"id":[0-9]*' | head -1 | cut -d: -f2)

          if [ -z "${RELEASE_ID}" ]; then
            echo "Release may already exist, fetching existing release..."
            EXISTING=$(curl -sS -H "Authorization: token ${FORGEJO_TOKEN}" \
              "${API}/releases/tags/${VERSION}")
            echo "Existing release response: ${EXISTING}"
            RELEASE_ID=$(echo "${EXISTING}" | grep -o '"id":[0-9]*' | head -1 | cut -d: -f2)
          fi

          if [ -z "${RELEASE_ID}" ]; then
            echo "Failed to create or fetch release"
            exit 1
          fi

          for ARCHIVE in dist/*; do
            [ -e "${ARCHIVE}" ] || continue
            NAME=$(basename "${ARCHIVE}")
            case "${NAME}" in
              *.tar.gz) CONTENT_TYPE="application/gzip" ;;
              *.deb)    CONTENT_TYPE="application/vnd.debian.binary-package" ;;
              *)        CONTENT_TYPE="application/octet-stream" ;;
            esac
            curl -sS -H "Authorization: token ${FORGEJO_TOKEN}" \
              -H "Content-Type: ${CONTENT_TYPE}" \
              --data-binary "@${ARCHIVE}" \
              "${API}/releases/${RELEASE_ID}/assets?name=${NAME}"
            echo "Uploaded ${NAME}"
          done

      - name: Update APT repository
        working-directory: src
        run: |
          VERSION=${{ github.ref_name }}

          git clone ssh://git@git-ssh.janvete.com:554/seth/apt.git apt-repo
          cp dist/*.deb apt-repo/

          cd apt-repo

          # Remove any corrupted .deb files left from previous failed runs
          for f in *.deb; do
            [ -e "$f" ] || continue
            if ! dpkg-deb -I "$f" >/dev/null 2>&1; then
              echo "Removing corrupted package: $f"
              rm -f "$f"
            fi
          done

          dpkg-scanpackages . > Packages
          gzip -k -f Packages

          cat > Release << RELEASE
          Origin: janvete
          Label: janvete
          Suite: stable
          Codename: stable
          Version: 1.0
          Architectures: amd64
          Components: main
          Description: janvete tools APT repository
          Date: $(date -Ru)
          RELEASE

          {
            echo "SHA256:"
            for f in Packages Packages.gz *.deb; do
              [ -e "$f" ] || continue
              printf " %s %16d %s\n" "$(sha256sum "$f" | cut -d' ' -f1)" "$(stat -c%s "$f")" "$f"
            done
          } >> Release

          git config user.email "forgejo-actions[bot]@janvete.com"
          git config user.name "forgejo-actions[bot]"
          git add -A
          git commit -m "chore: add lines ${VERSION}"
          git push