name: 'publish-release'
description: 'Publish a Gitea release with assets via API. Composite (bash + curl), zero node runtime.'
author: 'fristy'

inputs:
  token:
    description: 'Gitea API token with release write access'
    required: true
    default: ${{ github.token }}
  server_url:
    description: 'Gitea base URL'
    required: false
    default: ${{ github.server_url }}
  repository:
    description: 'Target repository in owner/repo format'
    required: false
    default: ${{ github.repository }}
  tag_name:
    description: 'Tag for the release'
    required: false
    default: ${{ github.ref_name }}
  name:
    description: 'Release title (defaults to tag name)'
    required: false
    default: ''
  body:
    description: 'Release notes (ignored when body_path is set)'
    required: false
    default: ''
  body_path:
    description: 'Path to a file with release notes'
    required: false
    default: ''
  draft:
    description: "'true' to create a draft release"
    required: false
    default: 'false'
  prerelease:
    description: "'true' to mark as pre-release"
    required: false
    default: 'false'
  target_commitish:
    description: 'Branch or SHA the tag is created from (defaults to default branch)'
    required: false
    default: ''
  files:
    description: 'Newline-delimited glob patterns of assets to upload'
    required: false
    default: ''
  sha256sum:
    description: "'true' to also upload a sha256sums.txt for the assets"
    required: false
    default: 'false'
  overwrite:
    description: "'true' to delete and recreate an existing release for the tag"
    required: false
    default: 'false'

outputs:
  release_id:
    description: 'Numeric ID of the created release'
    value: ${{ steps.publish.outputs.release_id }}
  release_url:
    description: 'HTML URL of the release page'
    value: ${{ steps.publish.outputs.release_url }}

runs:
  using: 'composite'
  steps:
    - id: publish
      shell: bash
      env:
        INPUT_TOKEN: ${{ inputs.token }}
        INPUT_SERVER_URL: ${{ inputs.server_url }}
        INPUT_REPOSITORY: ${{ inputs.repository }}
        INPUT_TAG_NAME: ${{ inputs.tag_name }}
        INPUT_NAME: ${{ inputs.name }}
        INPUT_BODY: ${{ inputs.body }}
        INPUT_BODY_PATH: ${{ inputs.body_path }}
        INPUT_DRAFT: ${{ inputs.draft }}
        INPUT_PRERELEASE: ${{ inputs.prerelease }}
        INPUT_TARGET_COMMITISH: ${{ inputs.target_commitish }}
        INPUT_FILES: ${{ inputs.files }}
        INPUT_SHA256SUM: ${{ inputs.sha256sum }}
        INPUT_OVERWRITE: ${{ inputs.overwrite }}
      run: |
        set -euo pipefail

        SERVER="${INPUT_SERVER_URL%/}"
        REPO="${INPUT_REPOSITORY}"
        TAG="${INPUT_TAG_NAME}"
        AUTH_HEADER="Authorization: token ${INPUT_TOKEN}"
        API="${SERVER}/api/v1"

        for flag in INPUT_DRAFT INPUT_PRERELEASE INPUT_OVERWRITE INPUT_SHA256SUM; do
          val="${!flag}"
          if [ "$val" != "true" ] && [ "$val" != "false" ]; then
            echo "::error::${flag#INPUT_} must be 'true' or 'false' (got '$val')" >&2
            exit 1
          fi
        done

        if command -v jq >/dev/null 2>&1; then
          JSON=json_jq
        elif command -v python3 >/dev/null 2>&1; then
          JSON=json_py
        else
          echo "::error::publish-release requires 'jq' or 'python3' on the runner" >&2
          exit 1
        fi

        json_get() { # file key
          if [ "$JSON" = "json_jq" ]; then
            jq -r --arg k "$2" '.[$k] // ""' "$1"
          else
            python3 - "$1" "$2" <<'PYEOF'
        import json, sys
        print(json.load(open(sys.argv[1])).get(sys.argv[2], ""))
        PYEOF
          fi
        }

        urlenc() { # string
          if [ "$JSON" = "json_jq" ]; then
            jq -nr --arg v "$1" '$v | @uri'
          else
            python3 - "$1" <<'PYEOF'
        import sys, urllib.parse
        print(urllib.parse.quote(sys.argv[1], safe=""))
        PYEOF
          fi
        }

        REL_NAME="$INPUT_NAME"
        [ -z "$REL_NAME" ] && REL_NAME="$TAG"
        REL_BODY="$INPUT_BODY"
        if [ -n "$INPUT_BODY_PATH" ]; then
          [ -f "$INPUT_BODY_PATH" ] || { echo "::error::body_path not found: $INPUT_BODY_PATH" >&2; exit 1; }
          REL_BODY="$(cat "$INPUT_BODY_PATH")"
        fi

        # Minimal tag encoding for the lookup path (covers owner/name style tags).
        TAG_ENC="${TAG//\//%2F}"

        echo "Checking for existing release '$TAG' in $REPO ..."
        HTTP_CODE=$(curl -sS -o /tmp/pr_existing.json -w '%{http_code}' -H "$AUTH_HEADER" "$API/repos/$REPO/releases/tags/$TAG_ENC")
        if [ "$HTTP_CODE" = "200" ]; then
          REL_ID="$(json_get /tmp/pr_existing.json id)"
          if [ "$INPUT_OVERWRITE" = "true" ]; then
            echo "Release exists (id=$REL_ID), deleting (overwrite=true) ..."
            DEL_CODE=$(curl -sS -o /dev/null -w '%{http_code}' -X DELETE -H "$AUTH_HEADER" "$API/repos/$REPO/releases/$REL_ID")
            [ "$DEL_CODE" = "204" ] || { echo "::error::failed to delete existing release (HTTP $DEL_CODE)" >&2; exit 1; }
            REL_ID=""
          else
            echo "::error::release '$TAG' already exists (id=$REL_ID). Set overwrite: 'true' to replace." >&2
            exit 1
          fi
        elif [ "$HTTP_CODE" != "404" ]; then
          echo "::error::release lookup failed (HTTP $HTTP_CODE):" >&2
          cat /tmp/pr_existing.json >&2
          exit 1
        fi

        if [ -z "${REL_ID:-}" ]; then
          echo "Creating release '$TAG' ..."
          if [ "$JSON" = "json_jq" ]; then
            PAYLOAD="$(jq -n --arg tag "$TAG" --arg name "$REL_NAME" --arg body "$REL_BODY" \
              --argjson draft "$INPUT_DRAFT" --argjson pre "$INPUT_PRERELEASE" --arg target "$INPUT_TARGET_COMMITISH" \
              '{tag_name:$tag,name:$name,body:$body,draft:$draft,prerelease:$pre} + (if $target == "" then {} else {target_commitish:$target} end)')"
          else
            PAYLOAD="$(TAG="$TAG" REL_NAME="$REL_NAME" REL_BODY="$REL_BODY" INPUT_DRAFT="$INPUT_DRAFT" INPUT_PRERELEASE="$INPUT_PRERELEASE" INPUT_TARGET_COMMITISH="$INPUT_TARGET_COMMITISH" python3 <<'PYEOF'
        import json, os
        p = {"tag_name": os.environ["TAG"], "name": os.environ["REL_NAME"], "body": os.environ["REL_BODY"],
             "draft": os.environ["INPUT_DRAFT"] == "true", "prerelease": os.environ["INPUT_PRERELEASE"] == "true"}
        if os.environ["INPUT_TARGET_COMMITISH"]:
            p["target_commitish"] = os.environ["INPUT_TARGET_COMMITISH"]
        print(json.dumps(p))
        PYEOF
            )"
          fi
          HTTP_CODE=$(curl -sS -o /tmp/pr_created.json -w '%{http_code}' -X POST -H "$AUTH_HEADER" -H 'Content-Type: application/json' -d "$PAYLOAD" "$API/repos/$REPO/releases")
          if [ "$HTTP_CODE" != "201" ]; then
            echo "::error::release creation failed (HTTP $HTTP_CODE):" >&2
            cat /tmp/pr_created.json >&2
            exit 1
          fi
          REL_ID="$(json_get /tmp/pr_created.json id)"
          echo "Release created (id=$REL_ID)."
        fi

        ASSETS=()
        while IFS= read -r pattern || [ -n "$pattern" ]; do
          pattern="$(printf '%s' "$pattern" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')"
          [ -z "$pattern" ] && continue
          # shellcheck disable=SC2206
          expanded=( $pattern )
          if [ "${#expanded[@]}" -eq 0 ]; then
            echo "::warning::pattern matched nothing: $pattern"
            continue
          fi
          for f in "${expanded[@]}"; do
            if [ -f "$f" ]; then ASSETS+=("$f"); else echo "::warning::not a file: $f"; fi
          done
        done <<< "$INPUT_FILES"

        if [ "$INPUT_SHA256SUM" = "true" ] && [ "${#ASSETS[@]}" -gt 0 ]; then
          WORKDIR="${GITHUB_WORKSPACE:-$PWD}"
          ( cd "$WORKDIR" && sha256sum "${ASSETS[@]}" > sha256sums.txt )
          ASSETS+=("$WORKDIR/sha256sums.txt")
          echo "sha256sums.txt generated."
        fi

        for f in ${ASSETS[@]+"${ASSETS[@]}"}; do
          fname="$(basename "$f")"
          ename="$(urlenc "$fname")"
          echo "Uploading $f ..."
          HTTP_CODE=$(curl -sS -o /tmp/pr_asset.json -w '%{http_code}' -X POST -H "$AUTH_HEADER" -H 'Content-Type: application/octet-stream' --data-binary "@$f" "$API/repos/$REPO/releases/$REL_ID/assets?name=$ename")
          if [ "$HTTP_CODE" != "201" ]; then
            echo "::error::asset upload failed for $f (HTTP $HTTP_CODE):" >&2
            cat /tmp/pr_asset.json >&2
            exit 1
          fi
        done

        REL_URL="$(json_get /tmp/pr_created.json html_url)"
        {
          echo "release_id=$REL_ID"
          echo "release_url=$REL_URL"
        } >> "${GITHUB_OUTPUT:-/dev/null}"
        echo "Done. release_id=$REL_ID url=$REL_URL"