softwarekatalog/.github/workflows/release.yml

name: Release

on:
  push:
    branches:
      - main
      - master
  workflow_dispatch:

permissions:
  contents: write

jobs:
  build-release:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Build dist
        run: make dist
        env:
          SOFTKAT_BUILD_COMMIT: ${{ github.sha }}

      - name: Package release zip
        run: |
          short_sha="${GITHUB_SHA::7}"
          archive="softwarekatalog-${short_sha}.zip"

          echo "SHORT_SHA=${short_sha}" >> "${GITHUB_ENV}"
          echo "ARCHIVE=${archive}" >> "${GITHUB_ENV}"

          rm -rf package
          mkdir -p package
          cp LICENSE package/LICENSE
          cp dist/setup.ps1 package/setup.ps1
          cp -R PolicyDefinitions package/PolicyDefinitions

          (cd package && zip -r "../${archive}" LICENSE setup.ps1 PolicyDefinitions)

      - name: Create or update release
        shell: bash
        env:
          ACTION_TOKEN: ${{ github.token }}
          RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
        run: |
          set -euo pipefail

          token="${RELEASE_TOKEN:-${ACTION_TOKEN:-}}"
          : "${token:?No release token available}"
          : "${GITHUB_API_URL:?GITHUB_API_URL is required}"
          : "${GITHUB_REPOSITORY:?GITHUB_REPOSITORY is required}"
          : "${GITHUB_SHA:?GITHUB_SHA is required}"
          : "${SHORT_SHA:?SHORT_SHA is required}"
          : "${ARCHIVE:?ARCHIVE is required}"

          api="${GITHUB_API_URL}"
          repo="${GITHUB_REPOSITORY}"
          tag="${SHORT_SHA}"
          archive="${ARCHIVE}"
          asset_name="$(basename "${archive}")"
          encoded_asset_name="$(python3 -c 'import sys, urllib.parse; print(urllib.parse.quote(sys.argv[1]))' "${asset_name}")"

          if [ "${GITEA_ACTIONS:-}" = "true" ]; then
            platform="gitea"
            auth_header="Authorization: token ${token}"
          else
            platform="github"
            auth_header="Authorization: Bearer ${token}"
          fi

          tmpdir="$(mktemp -d)"
          trap 'rm -rf "${tmpdir}"' EXIT

          curl_json() {
            local method="$1"
            local url="$2"
            local out="$3"
            shift 3

            curl -sS -L \
              -X "${method}" \
              -H "Accept: application/json" \
              -H "${auth_header}" \
              "$@" \
              -o "${out}" \
              -w "%{http_code}" \
              "${url}"
          }

          python3 - <<'PY' > "${tmpdir}/create-release.json"
          import json
          import os

          print(json.dumps({
              "tag_name": os.environ["SHORT_SHA"],
              "target_commitish": os.environ["GITHUB_SHA"],
              "name": os.environ["SHORT_SHA"],
              "body": f"Automated build for {os.environ['GITHUB_SHA']}.",
              "draft": False,
              "prerelease": False,
          }))
          PY

          release_json="${tmpdir}/release.json"

          status="$(
            curl_json GET \
              "${api}/repos/${repo}/releases/tags/${tag}" \
              "${release_json}"
          )"

          if [ "${status}" = "404" ]; then
            status="$(
              curl_json POST \
                "${api}/repos/${repo}/releases" \
                "${release_json}" \
                -H "Content-Type: application/json" \
                --data-binary "@${tmpdir}/create-release.json"
            )"

            if [ "${status}" != "201" ]; then
              echo "Failed to create release. HTTP ${status}"
              cat "${release_json}"
              exit 1
            fi
          elif [ "${status}" != "200" ]; then
            echo "Failed to look up release. HTTP ${status}"
            cat "${release_json}"
            exit 1
          fi

          release_id="$(
            python3 -c 'import json, sys; print(json.load(open(sys.argv[1]))["id"])' \
              "${release_json}"
          )"

          assets_json="${tmpdir}/assets.json"

          status="$(
            curl_json GET \
              "${api}/repos/${repo}/releases/${release_id}/assets" \
              "${assets_json}"
          )"

          if [ "${status}" != "200" ]; then
            echo "Failed to list release assets. HTTP ${status}"
            cat "${assets_json}"
            exit 1
          fi

          existing_asset_id="$(
            python3 - "${assets_json}" "${asset_name}" <<'PY'
          import json
          import sys

          assets = json.load(open(sys.argv[1]))
          wanted = sys.argv[2]

          for asset in assets:
              if asset.get("name") == wanted:
                  print(asset["id"])
                  break
          PY
          )"

          if [ -n "${existing_asset_id}" ]; then
            delete_json="${tmpdir}/delete-asset.json"

            if [ "${platform}" = "gitea" ]; then
              delete_url="${api}/repos/${repo}/releases/${release_id}/assets/${existing_asset_id}"
            else
              delete_url="${api}/repos/${repo}/releases/assets/${existing_asset_id}"
            fi

            status="$(curl_json DELETE "${delete_url}" "${delete_json}")"

            case "${status}" in
              200|204) ;;
              *)
                echo "Failed to delete existing asset. HTTP ${status}"
                cat "${delete_json}"
                exit 1
                ;;
            esac
          fi

          upload_json="${tmpdir}/upload-asset.json"

          if [ "${platform}" = "gitea" ]; then
            status="$(
              curl -sS -L \
                -X POST \
                -H "Accept: application/json" \
                -H "${auth_header}" \
                -F "attachment=@${archive};type=application/zip" \
                -o "${upload_json}" \
                -w "%{http_code}" \
                "${api}/repos/${repo}/releases/${release_id}/assets?name=${encoded_asset_name}"
            )"
          else
            upload_url="$(
              python3 -c 'import json, sys; print(json.load(open(sys.argv[1]))["upload_url"].split("{", 1)[0])' \
                "${release_json}"
            )"

            status="$(
              curl -sS -L \
                -X POST \
                -H "Accept: application/vnd.github+json" \
                -H "${auth_header}" \
                -H "Content-Type: application/zip" \
                --data-binary "@${archive}" \
                -o "${upload_json}" \
                -w "%{http_code}" \
                "${upload_url}?name=${encoded_asset_name}"
            )"
          fi

          case "${status}" in
            200|201)
              echo "Uploaded ${asset_name} to ${platform} release ${tag}."
              ;;
            *)
              echo "Failed to upload release asset. HTTP ${status}"
              cat "${upload_json}"
              exit 1
              ;;
          esac