name: Release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: write
  packages: write

jobs:
  prepare:
    name: Prepare release
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.version.outputs.version }}
      backend_image: ${{ steps.images.outputs.backend_image }}
      frontend_image: ${{ steps.images.outputs.frontend_image }}
      release_doc_url: ${{ steps.release_docs.outputs.release_doc_url }}
    steps:
      - uses: actions/checkout@v4
      - name: Resolve version
        id: version
        shell: bash
        run: |
          version="${GITHUB_REF_NAME#v}"
          if [ -z "$version" ] || [ "$version" = "$GITHUB_REF_NAME" ]; then
            echo "Tag must use v<version> format." >&2
            exit 1
          fi
          echo "version=$version" >> "$GITHUB_OUTPUT"
      - name: Resolve image names
        id: images
        shell: bash
        run: |
          owner="${GITHUB_REPOSITORY_OWNER,,}"
          repo="${GITHUB_REPOSITORY#*/}"
          repo="${repo,,}"
          echo "backend_image=ghcr.io/${owner}/${repo}/asp-backend:${{ steps.version.outputs.version }}" >> "$GITHUB_OUTPUT"
          echo "frontend_image=ghcr.io/${owner}/${repo}/asp-frontend:${{ steps.version.outputs.version }}" >> "$GITHUB_OUTPUT"
      - name: Resolve release docs URL
        id: release_docs
        run: |
          python - <<'PY' >> "$GITHUB_OUTPUT"
          import json
          import os
          from pathlib import Path

          version = "${{ steps.version.outputs.version }}"
          config = json.loads(Path("deploy/release-docs.json").read_text(encoding="utf-8"))
          slug = config.get("releases", {}).get(version)
          if not slug:
              raise SystemExit(f"Missing asf-doc release mapping for version {version} in deploy/release-docs.json")
          base_url = str(config["base_url"]).rstrip("/")
          print(f"release_doc_url={base_url}/{slug}/")
          PY

  images:
    name: Build and push images
    needs: prepare
    uses: ./.github/workflows/docker.yml
    with:
      version: ${{ needs.prepare.outputs.version }}
      push: true
    secrets: inherit

  release:
    name: Create GitHub Release
    runs-on: ubuntu-latest
    needs:
      - prepare
      - images
    steps:
      - uses: actions/checkout@v4
      - name: Build Compose package
        run: |
          bash ./deploy/package-asp-compose.sh \
            --version "${{ needs.prepare.outputs.version }}" \
            --output-dir dist \
            --backend-image "${{ needs.prepare.outputs.backend_image }}" \
            --frontend-image "${{ needs.prepare.outputs.frontend_image }}"
      - name: Validate package
        run: |
          version="${{ needs.prepare.outputs.version }}"
          archive_path="dist/asp-compose-$version.tar.gz"
          test -f "$archive_path"
          rm -rf dist/unpacked
          mkdir -p dist/unpacked
          tar -xzf "$archive_path" -C dist/unpacked
          grep -F "${{ needs.prepare.outputs.backend_image }}" dist/unpacked/asp-compose/.env.example
          grep -F "${{ needs.prepare.outputs.frontend_image }}" dist/unpacked/asp-compose/.env.example
          if find dist/unpacked -type f | grep -E 'custom/(modules|playbooks)/.+\.py$|custom/data/(modules|siem|playbooks)/.+\.(json|ya?ml|md)$'; then
            echo "Release custom template contains development samples." >&2
            exit 1
          fi
      - name: Write release body
        run: |
          version="${{ needs.prepare.outputs.version }}"
          cat > dist/release-body.md <<EOF
          ## Release notes

          Full release notes: ${{ needs.prepare.outputs.release_doc_url }}

          ## Downloads

          - asp-compose-$version.tar.gz

          ## Container images

          - \`${{ needs.prepare.outputs.backend_image }}\`
          - \`${{ needs.prepare.outputs.frontend_image }}\`
          EOF
      - name: Create release
        uses: softprops/action-gh-release@v2
        with:
          body_path: dist/release-body.md
          files: dist/asp-compose-${{ needs.prepare.outputs.version }}.tar.gz