name: Release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: write
  id-token: write
  packages: write

jobs:
  prepare:
    name: Prepare release
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.release.outputs.version }}
      backend_image: ${{ steps.release.outputs.backend_image }}
      frontend_image: ${{ steps.release.outputs.frontend_image }}
      release_doc_url: ${{ steps.release.outputs.release_doc_url }}
    steps:
      - uses: actions/checkout@v7
        with:
          submodules: true
      - name: Check release manifest
        run: python deploy/release_tool.py check --tag "$GITHUB_REF_NAME"
      - name: Resolve release outputs
        id: release
        run: python deploy/release_tool.py show --format github-output >> "$GITHUB_OUTPUT"

  images:
    name: Build and push images
    needs: prepare
    uses: ./.github/workflows/docker.yml
    with:
      version: ${{ needs.prepare.outputs.version }}
      push: true
    secrets: inherit

  release:
    name: Create GitHub Release
    runs-on: ubuntu-latest
    needs:
      - prepare
      - images
    steps:
      - uses: actions/checkout@v7
      - name: Build Compose package
        run: |
          bash ./deploy/package-asp-compose.sh \
            --version "${{ needs.prepare.outputs.version }}" \
            --output-dir dist \
            --backend-image "${{ needs.prepare.outputs.backend_image }}" \
            --frontend-image "${{ needs.prepare.outputs.frontend_image }}"
      - name: Validate package
        run: |
          archive_path="dist/asp-compose.tar.gz"
          test -f "$archive_path"
          tar -tzf "$archive_path" >/dev/null
          rm -rf dist/unpacked
          mkdir -p dist/unpacked
          tar -xzf "$archive_path" -C dist/unpacked
          test -x dist/unpacked/asp-compose/scripts/upgrade.sh
          test ! -e dist/unpacked/asp-compose/.env
          grep -F "${{ needs.prepare.outputs.backend_image }}" dist/unpacked/asp-compose/.env.example
          grep -F "${{ needs.prepare.outputs.frontend_image }}" dist/unpacked/asp-compose/.env.example
          if find dist/unpacked -type f | grep -E 'custom/(modules|playbooks)/.+\.py$|custom/data/(modules|siem|playbooks)/.+\.(json|ya?ml|md)$'; then
            echo "Release custom template contains development samples." >&2
            exit 1
          fi
      - name: Write release body
        run: |
          cat > dist/release-body.md <<EOF
          ## Release notes

          Full release notes: ${{ needs.prepare.outputs.release_doc_url }}

          ## Downloads

          - asp-compose.tar.gz

          ## Container images

          - \`${{ needs.prepare.outputs.backend_image }}\`
          - \`${{ needs.prepare.outputs.frontend_image }}\`
          EOF
      - name: Create release
        uses: softprops/action-gh-release@v3
        with:
          body_path: dist/release-body.md
          files: dist/asp-compose.tar.gz

  publish-cli:
    name: Publish CLI to PyPI
    runs-on: ubuntu-latest
    needs:
      - prepare
      - release
    environment:
      name: pypi
      url: https://pypi.org/p/asp-cli
    defaults:
      run:
        working-directory: cli
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-python@v6
        with:
          python-version: "3.14"
      - uses: astral-sh/setup-uv@v7
        with:
          enable-cache: true
      - name: Check CLI version matches release tag
        run: |
          python - <<'PY'
          import tomllib
          from pathlib import Path

          release_version = "${{ needs.prepare.outputs.version }}"
          pyproject = tomllib.loads(Path("pyproject.toml").read_text(encoding="utf-8"))
          cli_version = pyproject["project"]["version"]
          if cli_version != release_version:
              raise SystemExit(
                  f"cli/pyproject.toml version {cli_version!r} must match release tag version {release_version!r}"
              )
          PY
      - name: Build CLI package
        run: uv build
      - name: Check package metadata
        run: uvx twine check dist/*
      - name: Publish CLI package
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          packages-dir: cli/dist