name: Release

on:
  push:
    tags: ["v*"]

permissions:
  contents: write

jobs:
  distro-amd64:
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout Spinifex
        uses: actions/checkout@v6
        with:
          path: spinifex

      - name: Checkout Predastore
        uses: actions/checkout@v6
        with:
          repository: mulgadc/predastore
          path: predastore

      - name: Checkout Viperblock
        uses: actions/checkout@v6
        with:
          repository: mulgadc/viperblock
          path: viperblock

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Build amd64 Tarball
        env:
          VERSION: ${{ github.ref_name }}
        run: cd spinifex && make distro-amd64 VERSION="$VERSION"

      - name: Upload amd64 Artifacts
        uses: actions/upload-artifact@v4
        with:
          name: distro-amd64
          path: |
            spinifex/dist/spinifex-${{ github.ref_name }}-linux-amd64.tar.gz
            spinifex/dist/spinifex-${{ github.ref_name }}-linux-amd64.tar.gz.sha256
            spinifex/scripts/setup.sh

  distro-arm64:
    runs-on: ubuntu-24.04-arm
    steps:
      - name: Checkout Spinifex
        uses: actions/checkout@v6
        with:
          path: spinifex

      - name: Checkout Predastore
        uses: actions/checkout@v6
        with:
          repository: mulgadc/predastore
          path: predastore

      - name: Checkout Viperblock
        uses: actions/checkout@v6
        with:
          repository: mulgadc/viperblock
          path: viperblock

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Build arm64 Tarball
        env:
          VERSION: ${{ github.ref_name }}
        run: cd spinifex && make distro-arm64 VERSION="$VERSION"

      - name: Upload arm64 Artifacts
        uses: actions/upload-artifact@v4
        with:
          name: distro-arm64
          path: |
            spinifex/dist/spinifex-${{ github.ref_name }}-linux-arm64.tar.gz
            spinifex/dist/spinifex-${{ github.ref_name }}-linux-arm64.tar.gz.sha256

  release:
    needs: [distro-amd64, distro-arm64]
    runs-on: ubuntu-24.04
    steps:
      - name: Download amd64 Artifacts
        uses: actions/download-artifact@v4
        with:
          name: distro-amd64
          path: artifacts

      - name: Download arm64 Artifacts
        uses: actions/download-artifact@v4
        with:
          name: distro-arm64
          path: artifacts

      - name: Create Draft GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          draft: true
          files: |
            artifacts/**/*.tar.gz
            artifacts/**/*.sha256
            artifacts/**/setup.sh
          generate_release_notes: true

      - name: Upload Tarball for Verify Job
        uses: actions/upload-artifact@v4
        with:
          name: release-assets
          path: artifacts/

  verify:
    needs: release
    runs-on: [self-hosted, ci-single]
    timeout-minutes: 25
    env:
      TOFU_LOG: /tmp/release-verify-${{ github.run_id }}.log
      TAG: ${{ github.ref_name }}
      REPO: ${{ github.repository }}
    steps:
      - name: Clean Workspace
        run: rm -rf "$GITHUB_WORKSPACE"/*

      - uses: actions/create-github-app-token@v3
        id: app-token
        with:
          app-id: ${{ secrets.APP_ID }}
          private-key: ${{ secrets.APP_PRIVATE_KEY }}
          repositories: mulga

      - uses: actions/checkout@v6
        with:
          repository: mulgadc/mulga
          token: ${{ steps.app-token.outputs.token }}
          sparse-checkout: scripts/tofu-cluster
          path: mulga

      - name: Download Release Assets
        uses: actions/download-artifact@v4
        with:
          name: release-assets
          path: release-assets

      - name: Provision VM
        working-directory: mulga/scripts/tofu-cluster
        run: |
          tofu init -input=false >> "$TOFU_LOG" 2>&1
          tofu workspace select -or-create env3 >> "$TOFU_LOG" 2>&1
          tofu destroy -var-file=envs/env3.tfvars -auto-approve -input=false >> "$TOFU_LOG" 2>&1 || true
          ./scrub-env.sh env3 >> "$TOFU_LOG" 2>&1 || true
          tofu apply -var-file=envs/env3.tfvars -auto-approve -input=false >> "$TOFU_LOG" 2>&1

      - name: Bootstrap via Binary Install
        working-directory: mulga/scripts/tofu-cluster
        run: |
          SETUP_SH=$(find "${GITHUB_WORKSPACE}/release-assets" -name "setup.sh" | head -1)
          TARBALL=$(find "${GITHUB_WORKSPACE}/release-assets" -name "*-linux-amd64.tar.gz" | head -1)
          ./bootstrap-install.sh env3 "$SETUP_SH" "$TARBALL"

      - name: Run Smoke Test
        working-directory: mulga/scripts/tofu-cluster
        run: |
          INVENTORY=$(tofu output -json inventory)
          WAN_IP=$(echo "$INVENTORY" | jq -r '.nodes[0].wan_ip')
          SSH_KEY=$(echo "$INVENTORY" | jq -r '.ssh_key_path')
          SSH_KEY="${SSH_KEY/#\~/$HOME}"
          scp -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR \
            -i "$SSH_KEY" \
            smoke-test-install.sh \
            "tf-user@${WAN_IP}:/tmp/smoke-test.sh"
          ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR \
            -i "$SSH_KEY" "tf-user@${WAN_IP}" \
            'bash /tmp/smoke-test.sh'

      - name: Promote Release
        if: success()
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release edit "$TAG" --repo "$REPO" --draft=false
          echo "Release ${TAG} promoted to latest"

      - name: Mark Release Failed
        if: failure()
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          EXISTING_BODY=$(gh release view "$TAG" --repo "$REPO" --json body -q .body)
          NOTES_FILE=$(mktemp)
          printf 'Verification failed — see workflow run for details.\n\n%s' "$EXISTING_BODY" > "$NOTES_FILE"
          gh release edit "$TAG" --repo "$REPO" --notes-file "$NOTES_FILE"
          rm -f "$NOTES_FILE"

      - name: Teardown
        if: always()
        working-directory: mulga/scripts/tofu-cluster
        run: |
          tofu workspace select -or-create env3 >> "$TOFU_LOG" 2>&1
          tofu destroy -var-file=envs/env3.tfvars -auto-approve -input=false >> "$TOFU_LOG" 2>&1
          ./scrub-env.sh env3 >> "$TOFU_LOG" 2>&1 || true