# Attach the release files to the GitHub release of a tag v<version>.
#
# GitHub only: Gitea reads .gitea/workflows when it exists and then ignores
# this directory, so the forge's copy of this repository never runs this file.
#
# The files are not uploaded from anywhere else. This job rebuilds them from
# the tag and attaches them only when they are the published release:
#
#   1. bastion_agent/verify_release.py fetches the live manifest
#      (privatae.ai/bastion-agent/version.json) and its signature, checks the
#      signature against the release keys the bastion pins, refuses unless the
#      manifest names this tag's version and the tag is annotated with the line
#      `built from <built_from>`, rebuilds the .pyz from the tag with that
#      tag's own build.py, and compares the sha256 with the manifest;
#   2. only then are the rebuilt .pyz, its .sha256, the manifest (its exact
#      bytes) and the signature file attached to the release, which is created
#      when the tag has none, with that version's CHANGELOG section.
#
# The live manifest names only the newest release, so a release can be given
# its files only while it is the published one. Older releases, whose manifest
# is no longer served, cannot be filled in afterwards. A run that failed (the
# tag pushed before the release went live, say) is run again from the Actions
# tab with the tag as input.
#
# No action from the marketplace is used, and nothing is fetched with a
# credential: the repository is read from its public URL. The job may write
# to the repository's releases; the token is handed to the last step only.
name: release

on:
  push:
    tags: ["v*.*.*"]
  workflow_dispatch:
    inputs:
      tag:
        description: "the release tag, vX.Y.Z"
        required: true

permissions:
  contents: read

env:
  REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
  TAG: ${{ github.event.inputs.tag || github.ref_name }}

defaults:
  run:
    shell: bash -euo pipefail {0}

jobs:
  release:
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    permissions:
      contents: write
    steps:
      - name: the tag is a release tag
        run: |
          printf '%s\n' "$TAG" | grep -Exq 'v[0-9]+\.[0-9]+\.[0-9]+' \
            || { echo "not a release tag: $TAG"; exit 1; }
      - name: fetch the repository and its tags
        # verify_release.py is run from the commit this workflow runs from: the
        # tag itself on a tag push, the default branch on a manual run. It
        # builds the tag's own source in a separate worktree.
        run: |
          git init -q .
          git remote add origin "$REPO_URL"
          git fetch -q origin "+refs/tags/*:refs/tags/*" "$GITHUB_SHA"
          git checkout -q --detach "$GITHUB_SHA"
          test "$(git rev-parse HEAD)" = "$GITHUB_SHA"
          git rev-parse -q --verify "refs/tags/$TAG^{commit}" >/dev/null \
            || { echo "no tag $TAG in this repository"; exit 1; }
      - name: check the signed manifest and rebuild the .pyz from the tag
        run: |
          # The PyYAML release bastion_agent/build.py vendors, as a wheel only
          # and only with one of these sha256s (PyPI's, for Linux on x86_64 and
          # arm64, Python 3.12 and 3.13): the one package this job takes from
          # outside the repository, and this step runs before the upload step
          # that holds the token. A different PyYAML would only make the
          # rebuild differ and the step refuse.
          cat > "$RUNNER_TEMP/requirements.txt" <<'REQ'
          pyyaml==6.0.3 \
            --hash=sha256:ba1cc08a7ccde2d2ec775841541641e4548226580ab850948cbfda66a1befcdc \
            --hash=sha256:9149cad251584d5fb4981be1ecde53a1ca46c891a79788c0df828d2f166bda28 \
            --hash=sha256:0f29edc409a6392443abf94b9cf89ce99889a1dd5376d94316ae5145dfedd5d6 \
            --hash=sha256:ee2922902c45ae8ccada2c5b501ab86c36525b883eff4255313a253a3160861c
          REQ
          /usr/bin/python3 -m venv /tmp/venv
          /tmp/venv/bin/pip install -q --disable-pip-version-check --only-binary :all: \
            --require-hashes -r "$RUNNER_TEMP/requirements.txt"
          /tmp/venv/bin/python -m bastion_agent.verify_release \
            --expect-version "$TAG" --out "$RUNNER_TEMP/release"
          ls -l "$RUNNER_TEMP/release"
      - name: the release notes, from that version's CHANGELOG section
        run: |
          /usr/bin/git show "$TAG:CHANGELOG.md" > "$RUNNER_TEMP/CHANGELOG.md"
          /usr/bin/python3 -I - "${TAG#v}" "$RUNNER_TEMP/CHANGELOG.md" > "$RUNNER_TEMP/notes.md" <<'PY'
          import re, sys
          ver, path = sys.argv[1], sys.argv[2]
          text = open(path, encoding="utf-8").read()
          m = re.search(r"^## %s[ \t]*\n(.*?)(?=^## |\Z)" % re.escape(ver), text, re.M | re.S)
          if not m:
              sys.exit("CHANGELOG.md at the tag has no section for %s" % ver)
          print(m.group(1).strip())
          print()
          print("---")
          print("The files below are this tag rebuilt by this repository's release workflow, "
                "attached only after their sha256 matched the signed manifest "
                "(`version.json` and its `.sig`). To check them yourself, run "
                "`python3 -m bastion_agent.verify_release` from a clone: "
                "see [Verify a release](https://github.com/%s#verify-a-release)."
                % "Privatae/bastion-agent")
          PY
      - name: attach the files to the release
        # The one step with the token. Its shell and Python are named by path,
        # and Python runs isolated (-I), so nothing an earlier step put on PATH
        # or in the environment chooses what runs here.
        shell: /usr/bin/bash -euo pipefail {0}
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
        run: |
          /usr/bin/python3 -I - "$RUNNER_TEMP/release" "$RUNNER_TEMP/notes.md" <<'PY'
          import json, os, sys, urllib.error, urllib.parse, urllib.request

          out_dir, notes = sys.argv[1], sys.argv[2]
          api = os.environ.get("GITHUB_API_URL", "https://api.github.com").rstrip("/")
          repo, tag, token = os.environ["GH_REPO"], os.environ["TAG"], os.environ["GH_TOKEN"]

          def call(method, url, body=None, ctype="application/json"):
              data = body if isinstance(body, bytes) or body is None else json.dumps(body).encode()
              req = urllib.request.Request(url, data=data, method=method, headers={
                  "Authorization": "Bearer " + token, "Accept": "application/vnd.github+json",
                  "X-GitHub-Api-Version": "2022-11-28", "Content-Type": ctype,
                  "User-Agent": "bastion-agent-release"})
              try:
                  with urllib.request.urlopen(req, timeout=120) as r:
                      raw = r.read()
                      return r.status, json.loads(raw) if raw else None
              except urllib.error.HTTPError as e:
                  return e.code, None

          st, rel = call("GET", "%s/repos/%s/releases/tags/%s" % (api, repo, tag))
          if st == 404:
              body = open(notes, encoding="utf-8").read()
              st, rel = call("POST", "%s/repos/%s/releases" % (api, repo), {
                  "tag_name": tag, "name": "bastion agent " + tag[1:], "body": body,
                  "draft": False, "prerelease": False})
              if st != 201:
                  sys.exit("creating the release for %s failed: HTTP %d" % (tag, st))
              print("created the release for %s" % tag)
          elif st != 200:
              sys.exit("reading the release for %s failed: HTTP %d" % (tag, st))
          else:
              print("the release for %s exists; its text is left as it is" % tag)

          st, assets = call("GET", "%s/repos/%s/releases/%d/assets?per_page=100" % (api, repo, rel["id"]))
          if st != 200:
              sys.exit("listing the release's files failed: HTTP %d" % st)
          have = {a["name"]: a["id"] for a in assets}
          upload = rel["upload_url"].split("{", 1)[0]
          for name in sorted(os.listdir(out_dir)):
              if name in have:
                  st, _ = call("DELETE", "%s/repos/%s/releases/assets/%d" % (api, repo, have[name]))
                  if st != 204:
                      sys.exit("replacing %s failed: HTTP %d" % (name, st))
              with open(os.path.join(out_dir, name), "rb") as fh:
                  data = fh.read()
              st, a = call("POST", upload + "?" + urllib.parse.urlencode({"name": name}), data,
                           "application/octet-stream")
              if st != 201:
                  sys.exit("uploading %s failed: HTTP %d" % (name, st))
              print("attached %s (%d bytes)" % (a["name"], a["size"]))
          PY