name: Release prepare

on:
  workflow_dispatch:
    inputs:
      bump_kind:
        description: 'How to bump the version (ignored if version_override is set)'
        type: choice
        options: [build, patch, minor, major]
        default: build
      version_type:
        description: 'Channel for the new version (keep-current preserves current type)'
        type: choice
        options: [keep-current, rc, beta]
        default: keep-current
      version_override:
        description: 'Explicit version, e.g. 5.1.2-rc0 (overrides bump_kind/version_type)'
        type: string
        default: ''
      expected_current:
        description: 'Optional safety check: fail if current version.properties does not match (e.g. 5.1.1-rc0)'
        type: string
        default: ''
      dry_run:
        description: 'When true: compute and validate only. When false: commit, tag, push, dispatch release-tag.yml.'
        type: boolean
        default: true

permissions:
  contents: read

concurrency:
  group: release-prepare-main
  cancel-in-progress: false

jobs:
  compute-and-validate:
    name: Compute and validate
    runs-on: ubuntu-22.04
    permissions:
      contents: read
    outputs:
      new_name: ${{ steps.plan.outputs.new_name }}
      new_code: ${{ steps.plan.outputs.new_code }}
      current_name: ${{ steps.plan.outputs.current_name }}
    env:
      INPUT_BUMP_KIND: ${{ inputs.bump_kind }}
      INPUT_VERSION_TYPE: ${{ inputs.version_type }}
      INPUT_VERSION_OVERRIDE: ${{ inputs.version_override }}
      INPUT_EXPECTED_CURRENT: ${{ inputs.expected_current }}
    steps:
      - name: Guard ref must be main
        run: |
          if [[ "${GITHUB_REF}" != "refs/heads/main" ]]; then
            echo "Must dispatch from main, got ${GITHUB_REF}" >&2
            exit 1
          fi

      - name: Checkout main
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
        with:
          ref: main
          fetch-depth: 0
          persist-credentials: false

      - name: Compute and validate
        id: plan
        run: |
          set -euo pipefail
          args=("--mode=plan")
          if [[ -n "${INPUT_VERSION_OVERRIDE}" ]]; then
            args+=("--version-override=${INPUT_VERSION_OVERRIDE}")
          else
            args+=("--bump-kind=${INPUT_BUMP_KIND}")
            args+=("--version-type=${INPUT_VERSION_TYPE}")
          fi
          if [[ -n "${INPUT_EXPECTED_CURRENT}" ]]; then
            args+=("--expected-current=${INPUT_EXPECTED_CURRENT}")
          fi
          ./tools/release/bump.sh "${args[@]}" | tee plan.txt
          {
            grep -E '^current_name=' plan.txt
            grep -E '^new_name=' plan.txt
            grep -E '^new_code=' plan.txt
          } >> "$GITHUB_OUTPUT"

      - name: Tag collision check (local + remote)
        env:
          NEW_NAME: ${{ steps.plan.outputs.new_name }}
        run: |
          set -euo pipefail
          if git rev-parse --verify "refs/tags/v${NEW_NAME}" >/dev/null 2>&1; then
            echo "Local tag v${NEW_NAME} already exists" >&2
            exit 1
          fi
          if git ls-remote --exit-code --tags origin "refs/tags/v${NEW_NAME}" >/dev/null; then
            echo "Remote tag v${NEW_NAME} already exists" >&2
            exit 1
          fi

      - name: Write step summary
        env:
          CURRENT_NAME: ${{ steps.plan.outputs.current_name }}
          NEW_NAME: ${{ steps.plan.outputs.new_name }}
          NEW_CODE: ${{ steps.plan.outputs.new_code }}
          DRY_RUN: ${{ inputs.dry_run }}
        run: |
          set -euo pipefail
          {
            echo "## Release plan"
            echo
            echo "| | |"
            echo "|---|---|"
            echo "| Current | \`${CURRENT_NAME}\` |"
            echo "| New | \`${NEW_NAME}\` (code ${NEW_CODE}) |"
            echo "| Tag | \`v${NEW_NAME}\` |"
            echo "| Dry run | \`${DRY_RUN}\` |"
            echo
            echo "### bump.sh output"
            echo
            echo '```'
            cat plan.txt
            echo '```'
          } >> "$GITHUB_STEP_SUMMARY"

  push-and-dispatch:
    name: Push and dispatch
    needs: compute-and-validate
    if: ${{ !inputs.dry_run }}
    runs-on: ubuntu-22.04
    permissions:
      contents: read
    env:
      INPUT_BUMP_KIND: ${{ inputs.bump_kind }}
      INPUT_VERSION_TYPE: ${{ inputs.version_type }}
      INPUT_VERSION_OVERRIDE: ${{ inputs.version_override }}
      NEW_NAME: ${{ needs.compute-and-validate.outputs.new_name }}
      NEW_CODE: ${{ needs.compute-and-validate.outputs.new_code }}
      CURRENT_NAME_AT_PLAN: ${{ needs.compute-and-validate.outputs.current_name }}
    steps:
      - name: Mint App token
        id: app-token
        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 #v3.1.1
        with:
          client-id: ${{ secrets.RELEASE_APP_CLIENT_ID }}
          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}

      - name: Resolve bot identity
        id: bot
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          APP_SLUG: ${{ steps.app-token.outputs.app-slug }}
        run: |
          set -euo pipefail
          user_id=$(gh api "/users/${APP_SLUG}%5Bbot%5D" --jq .id)
          echo "user_name=${APP_SLUG}[bot]" >> "$GITHUB_OUTPUT"
          echo "user_email=${user_id}+${APP_SLUG}[bot]@users.noreply.github.com" >> "$GITHUB_OUTPUT"

      - name: Checkout main with credentials
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
        with:
          ref: main
          fetch-depth: 0
          persist-credentials: true
          token: ${{ steps.app-token.outputs.token }}

      - name: Verify state still matches plan from Job 1
        run: |
          set -euo pipefail
          ./tools/release/bump.sh --mode=check --expected-current="${CURRENT_NAME_AT_PLAN}"

      - name: Re-check tag collision (state may have moved between jobs)
        run: |
          set -euo pipefail
          if git rev-parse --verify "refs/tags/v${NEW_NAME}" >/dev/null 2>&1; then
            echo "Local tag v${NEW_NAME} already exists" >&2
            exit 1
          fi
          if git ls-remote --exit-code --tags origin "refs/tags/v${NEW_NAME}" >/dev/null; then
            echo "Remote tag v${NEW_NAME} already exists" >&2
            exit 1
          fi

      - name: Apply bump
        run: |
          set -euo pipefail
          args=("--mode=write" "--expected-current=${CURRENT_NAME_AT_PLAN}")
          if [[ -n "${INPUT_VERSION_OVERRIDE}" ]]; then
            args+=("--version-override=${INPUT_VERSION_OVERRIDE}")
          else
            args+=("--bump-kind=${INPUT_BUMP_KIND}")
            args+=("--version-type=${INPUT_VERSION_TYPE}")
          fi
          ./tools/release/bump.sh "${args[@]}"

      - name: Verify post-write state matches plan
        run: |
          set -euo pipefail
          ./tools/release/bump.sh --mode=check --expected-current="${NEW_NAME}"

      - name: Configure git identity
        env:
          BOT_USER_NAME: ${{ steps.bot.outputs.user_name }}
          BOT_USER_EMAIL: ${{ steps.bot.outputs.user_email }}
        run: |
          git config user.name "${BOT_USER_NAME}"
          git config user.email "${BOT_USER_EMAIL}"

      - name: Commit and tag
        run: |
          set -euo pipefail
          git add version.properties VERSION
          git commit -m "Release: ${NEW_NAME}"
          git tag -a "v${NEW_NAME}" -m "Release v${NEW_NAME}"

      - name: Atomic push (commit + tag)
        run: |
          set -euo pipefail
          git push --atomic origin "HEAD:refs/heads/main" "refs/tags/v${NEW_NAME}"

      - name: Write step summary
        run: |
          set -euo pipefail
          {
            echo "## Released"
            echo
            echo "| | |"
            echo "|---|---|"
            echo "| Tag | \`v${NEW_NAME}\` |"
            echo "| Version code | \`${NEW_CODE}\` |"
            echo "| Bump commit | on \`main\` |"
            echo "| Downstream | dispatched \`release-tag.yml\` |"
            echo
            echo "Watch the [Tagged releases](../../actions/workflows/release-tag.yml) workflow for the build + upload."
          } >> "$GITHUB_STEP_SUMMARY"