name: Release

# Publishes a GitHub Release for a version tag (vX.Y.Z).
#
# By design, this workflow does NOT bump versions or modify podman.plg
# itself — that happens locally via `scripts/release.sh <version>`, which a
# maintainer reviews, commits, and tags *before* pushing the tag (see that
# script's own printed instructions). This workflow's only job is to:
#   1. Rebuild all packages from the tagged commit in a clean Slackware
#      container (reproducibility check + provenance — we don't trust
#      whatever a maintainer happened to have in their local dist/).
#   2. Verify checksums match what's already committed in plugin/podman.plg
#      at this tag (catches a release.sh run that wasn't followed by a
#      matching commit — see the "Verify plg matches build" step).
#   3. Create the GitHub Release and attach the .txz packages, checksum
#      manifests, and podman.plg.
#
# See docs/ARCHITECTURE.md section 13 (Updates).

on:
  push:
    tags:
      - "v*.*.*"

permissions:
  contents: write

jobs:
  build:
    name: Build release packages
    uses: ./.github/workflows/build-packages.yml

  publish:
    name: Publish GitHub Release
    needs: build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Download built packages
        uses: actions/download-artifact@v4
        with:
          name: ${{ needs.build.outputs.artifact-name }}
          path: dist

      - name: Re-verify checksums
        run: scripts/checksums.sh dist

      - name: Verify plugin/podman.plg matches these artifacts
        # scripts/release.sh should already have been run locally, and its
        # resulting podman.plg changes committed as part of this tag, before
        # the tag was pushed. This step fails the release loudly if that
        # didn't happen, instead of publishing a release whose plg points at
        # MD5s that don't match the .txz files actually attached below.
        run: |
          set -eu
          for f in dist/*.txz.md5; do
            expected_md5=$(awk '{print $1}' "$f")
            txz_name=$(basename "${f%.md5}")
            if ! grep -qF "$expected_md5" plugin/podman.plg; then
              echo "!! $txz_name's checksum ($expected_md5) is not referenced in plugin/podman.plg." >&2
              echo "!! Did you forget to run scripts/release.sh and commit its changes before tagging?" >&2
              exit 1
            fi
          done
          echo "All package checksums are referenced in plugin/podman.plg — OK."

      - name: Extract version from tag
        id: version
        run: echo "value=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

      - name: Extract changelog section for this version
        id: changelog
        run: |
          awk -v ver="${{ steps.version.outputs.value }}" '
            $0 ~ "^## \\[" ver "\\]" { found=1; print; next }
            found && /^## \[/ { exit }
            found { print }
          ' CHANGELOG.md > /tmp/release-notes.md
          echo "path=/tmp/release-notes.md" >> "$GITHUB_OUTPUT"

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          name: "unraid-podman v${{ steps.version.outputs.value }}"
          body_path: ${{ steps.changelog.outputs.path }}
          # v0.x tags are treated as pre-releases until the plugin reaches a
          # first stable 1.0.0 — see docs/ROADMAP.md.
          prerelease: ${{ startsWith(steps.version.outputs.value, '0.') }}
          files: |
            dist/*.txz
            dist/*.sha256
            dist/*.md5
            dist/CHECKSUMS.sha256
            dist/CHECKSUMS.md5
            plugin/podman.plg