name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with: { python-version: "3.11" }
      - run: pip install -r requirements.txt
      - run: python3 -m pytest tests/ -q

  build-release:
    runs-on: ubuntu-latest
    needs: lint
    steps:
      - uses: actions/checkout@v4
      - name: Build deterministic release bundle
        run: |
          SOURCE_DATE_EPOCH="$(git show -s --format=%ct "$GITHUB_SHA")"
          python3 scripts/build_release.py \
            --root . \
            --output-dir dist \
            --commit "$GITHUB_SHA" \
            --source-date-epoch "$SOURCE_DATE_EPOCH"
      - name: Upload tested release bundle
        uses: actions/upload-artifact@v3
        with:
          name: release-bundle
          path: dist/

  release-candidate:
    runs-on: ubuntu-latest
    needs: [lint, build-release]
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4
      - name: Download tested release bundle
        uses: actions/download-artifact@v3
        with:
          name: release-bundle
          path: dist
      - name: Verify and publish release candidate
        env:
          TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          TARGET="${{ github.sha }}"
          TAG="v0.1.0-rc.${{ github.run_number }}"
          RELEASE_URL="${{ github.server_url }}/api/v1/repos/${{ github.repository }}/releases"

          (cd dist && sha256sum -c ./*.sha256)
          python3 scripts/verify_release.py --input-dir dist --commit "$TARGET"

          printf '{"tag_name":"%s","target_commitish":"%s","name":"Release Candidate %s","body":"CI-tested release candidate for commit %s. Verify downloads with the attached SHA-256 checksum.","draft":true,"prerelease":true}\n' \
            "$TAG" "$TARGET" "$TAG" "$TARGET" > /tmp/release.json
          curl --fail-with-body -sS -X POST "$RELEASE_URL" \
            -H "Authorization: token $TOKEN" \
            -H "Content-Type: application/json" \
            --data-binary @/tmp/release.json > /tmp/release-response.json
          RELEASE_ID="$(python3 -c 'import json; print(json.load(open("/tmp/release-response.json"))["id"])')"

          for ASSET in dist/*; do
            NAME="$(basename "$ASSET")"
            ENCODED_NAME="$(python3 -c 'import sys,urllib.parse; print(urllib.parse.quote(sys.argv[1]))' "$NAME")"
            curl --fail-with-body -sS -X POST "$RELEASE_URL/$RELEASE_ID/assets?name=$ENCODED_NAME" \
              -H "Authorization: token $TOKEN" \
              -H "Content-Type: application/octet-stream" \
              --data-binary "@$ASSET"
          done

          printf '{"draft":false,"prerelease":true}\n' > /tmp/publish.json
          curl --fail-with-body -sS -X PATCH "$RELEASE_URL/$RELEASE_ID" \
            -H "Authorization: token $TOKEN" \
            -H "Content-Type: application/json" \
            --data-binary @/tmp/publish.json