#!/bin/sh
# Publish a signed release APK to a Codeberg (Forgejo) release. Run on a tag,
# after ci/build.sh has produced a signed app-release.apk (signing happens when
# keystore.properties is present).
#
# Environment:
#   CODEBERG_TOKEN  Forgejo API token (secret)
#   CODEBERG_REPO   owner/name, e.g. lena/rsend
#   TAG             release tag (defaults to CI_COMMIT_TAG)
#   CODEBERG_URL    base URL (defaults to https://codeberg.org)
set -eu

: "${CODEBERG_TOKEN:?set CODEBERG_TOKEN}"
: "${CODEBERG_REPO:?set CODEBERG_REPO as owner/name}"
tag=${TAG:-${CI_COMMIT_TAG:?set TAG or CI_COMMIT_TAG}}
base=${CODEBERG_URL:-https://codeberg.org}
base=${base%/}
root=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
apk="$root/app/build/outputs/apk/release/app-release.apk"
source_commit="$root/app/build/outputs/apk/release/.source-commit"

[ -f "$apk" ] || { echo "release: $apk not found; run ci/build.sh first" >&2; exit 1; }
[ -f "$source_commit" ] || { echo "release: build provenance not found; run ci/build.sh first" >&2; exit 1; }
command -v apksigner >/dev/null 2>&1 || { echo "release: apksigner is required" >&2; exit 1; }
apksigner verify --verbose --print-certs "$apk"

[ -z "$(git -C "$root" status --porcelain --untracked-files=normal)" ] || {
	echo "release: working tree is not clean" >&2
	exit 1
}

case $CODEBERG_REPO in
	*[!A-Za-z0-9._/-]*|*/*/*|/*|*/)
		echo "release: invalid CODEBERG_REPO" >&2
		exit 1
		;;
	*/*) ;;
	*)
		echo "release: CODEBERG_REPO must be owner/name" >&2
		exit 1
		;;
esac

head=$(git -C "$root" rev-parse HEAD)
IFS= read -r built_commit < "$source_commit"
[ "$built_commit" = "$head" ] || { echo "release: APK was not built from HEAD" >&2; exit 1; }
git check-ref-format "refs/tags/$tag" >/dev/null 2>&1 || { echo "release: invalid tag $tag" >&2; exit 1; }
tag_head=$(git -C "$root" rev-parse --verify "$tag^{commit}")
[ "$head" = "$tag_head" ] || { echo "release: $tag does not point to HEAD" >&2; exit 1; }
version=$(python3 -c 'import re,sys
s=open(sys.argv[1]).read()
m=re.search(r"^\s*versionName [\x27\x22]([^\x27\x22]+)", s, re.M)
print(m.group(1) if m else "")' "$root/app/build.gradle")
[ "$tag" = "$version" ] || { echo "release: tag $tag does not match app version $version" >&2; exit 1; }

quote() {
	python3 -c 'import sys, urllib.parse; print(urllib.parse.quote(sys.argv[1], safe=""))' "$1"
}

api="$base/api/v1/repos/$CODEBERG_REPO"
auth="Authorization: token $CODEBERG_TOKEN"
name="rsend-$tag.apk"
sum_name="$name.sha256"
tag_url=$(quote "$tag")
name_url=$(quote "$name")
sum_name_url=$(quote "$sum_name")
sum=$(mktemp)
trap 'rm -f "$sum"' 0
sha256sum "$apk" | { read -r hash _; printf '%s  %s\n' "$hash" "$name"; } > "$sum"

# Reuse the tag's release if it exists, else create it. Published assets are
# immutable: a rerun uploads only missing assets and never replaces one.
id=$(curl -fsS -H "$auth" "$api/releases/tags/$tag_url" 2>/dev/null \
	| python3 -c 'import json,sys; print(json.load(sys.stdin)["id"])' 2>/dev/null) || id=
if [ -n "$id" ]; then
	assets=$(curl -fsS -H "$auth" "$api/releases/$id/assets")
else
	payload=$(python3 -c 'import json,sys; print(json.dumps({"tag_name":sys.argv[1],"name":sys.argv[1]}))' "$tag")
	id=$(curl -fsS -X POST "$api/releases" \
		-H "$auth" -H "Content-Type: application/json" \
		-d "$payload" \
		| python3 -c 'import json,sys; print(json.load(sys.stdin)["id"])')
fi
[ -n "$id" ] || { echo "release: could not create release for $tag" >&2; exit 1; }

has_asset() {
	printf '%s' "${assets:-[]}" | python3 -c 'import json,sys
name=sys.argv[1]
raise SystemExit(0 if any(a["name"] == name for a in json.load(sys.stdin)) else 1)' "$1"
}

if ! has_asset "$name"; then
	curl -fsS -X POST "$api/releases/$id/assets?name=$name_url" \
		-H "$auth" \
		-F "attachment=@$apk" >/dev/null
fi
if ! has_asset "$sum_name"; then
	curl -fsS -X POST "$api/releases/$id/assets?name=$sum_name_url" \
		-H "$auth" \
		-F "attachment=@$sum" >/dev/null
fi

echo "release: $name and $sum_name are present on $CODEBERG_REPO ($tag)"