#!/usr/bin/env bash
# Publish a BlueGit release for the tag that started this pipeline.
#
# Syntax checked against docs/CI.md and timfa/posprint scripts/ci/release.sh:
#   POST "$CI_API_URL/repos/$CI_PROJECT_PATH/releases"
#   Authorization: Bearer $CI_JOB_TOKEN
#   assets: {job, path, name} where path is an artifact of a successful job
#   in this pipeline.
#
# Verified limit (timfa/bluegit internal/server/ops_ci.go opPublishRelease and
# release_replace.go checkReplace): if the tag already exists the API returns
# HTTP 409 unless replace=true, and replace=true is rejected with HTTP 403 on
# a tag pipeline. A pipeline started by pushing the tag therefore cannot
# attach these artifacts to that same tag. The script still performs the
# documented call and fails when the response is not 2xx. It does not send
# replace=true, and it does not invent a second tag.
set -euo pipefail

: "${CI_API_URL:?}" "${CI_JOB_TOKEN:?}" "${CI_COMMIT_SHA:?}" "${CI_PROJECT_PATH:?}" "${CI_COMMIT_TAG:?}"

root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
cd "$root"
version="$(bash scripts/ci/package-version.sh)"

echo "BlueGit release API creates the git tag." >&2
echo "This pipeline already runs on tag ${CI_COMMIT_TAG}, so today's API returns 409 (tag exists)." >&2
echo "replace=true is refused on a tag pipeline (403). No second tag is created." >&2

asset() {
  printf '{"job":"%s","path":"%s","name":"%s"}' "$1" "$2" "$3"
}

assets="$(asset package:appimage dist/paperdoll-renderer-x86_64.AppImage "paperdoll-renderer-${version}-x86_64.AppImage")"
assets="${assets},$(asset package:ubuntu dist/paperdoll-renderer_amd64.deb "paperdoll-renderer_${version}_amd64.deb")"
assets="${assets},$(asset package:arch dist/paperdoll-renderer-x86_64.pkg.tar.zst "paperdoll-renderer-${version}-1-x86_64.pkg.tar.zst")"
assets="${assets},$(asset package:windows dist/paperdoll-renderer-windows-x86_64.zip "paperdoll-renderer-${version}-windows-x86_64.zip")"
assets="${assets},$(asset verify:packages dist/SHA256SUMS "paperdoll-renderer-${version}-SHA256SUMS")"

body="Paperdoll Renderer ${version}.\\n\\nFoundation shell only. Import, skeletal animation, paperdoll rendering and the 2D preview are not in this build.\\n\\n* Linux AppImage: paperdoll-renderer-${version}-x86_64.AppImage\\n* Debian/Ubuntu: paperdoll-renderer_${version}_amd64.deb\\n* Arch: paperdoll-renderer-${version}-1-x86_64.pkg.tar.zst\\n* Windows zip: paperdoll-renderer-${version}-windows-x86_64.zip\\n* SHA256SUMS"

payload="$(printf '{"tag":"%s","commit":"%s","name":"Paperdoll Renderer %s","body":"%s","assets":[%s]}' \
  "$CI_COMMIT_TAG" "$CI_COMMIT_SHA" "$version" "$body" "$assets")"

response="$(mktemp)"
code="$(curl -sS -o "$response" -w '%{http_code}' -X POST "$CI_API_URL/repos/$CI_PROJECT_PATH/releases" \
  -H "Authorization: Bearer $CI_JOB_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$payload")" || code=000
cat "$response"
echo
if [[ "$code" != 2* ]]; then
  echo "Release API returned HTTP ${code}. A 409 on this tag pipeline matches the verified BlueGit limit and is not a published release." >&2
  exit 1
fi
echo "release published for ${CI_COMMIT_TAG}"