name: Release Chart

on:
  push:
    branches:
      - main
    paths:
      - charts/**
      - .cr.yaml
      - .github/workflows/release-chart.yaml
  workflow_dispatch:

permissions:
  contents: write
  packages: write

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Install Helm
        uses: azure/setup-helm@v4

      - name: Package Helm chart
        run: |
          set -euo pipefail

          chart_dir="charts/kks-provider-plugin"
          chart_name=$(awk -F': *' '/^name:/ {print $2; exit}' "${chart_dir}/Chart.yaml")
          chart_version=$(awk -F': *' '/^version:/ {print $2; exit}' "${chart_dir}/Chart.yaml" | tr -d '"')
          release_tag="${chart_name}-${chart_version}"

          helm lint "$chart_dir"
          mkdir -p .cr-release-packages
          helm package "$chart_dir" --destination .cr-release-packages

          echo "GITEA_RELEASE_TAG=${release_tag}" >> "$GITHUB_ENV"

      - name: Upload chart artifacts to Gitea release
        if: secrets.GITEA_TOKEN != ''
        env:
          GITEA_BASE_URL: https://git.kloude.ir
          GITEA_REPO: kloude/kks-provider-plugin
          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
          TAG: ${{ env.GITEA_RELEASE_TAG }}
        run: |
          set -euo pipefail

          shopt -s nullglob
          charts=(.cr-release-packages/*.tgz)
          if [ ${#charts[@]} -eq 0 ]; then
            echo "No packaged charts to upload to Gitea"
            exit 0
          fi

          api="${GITEA_BASE_URL}/api/v1/repos/${GITEA_REPO}"

          release_json=$(curl -fsS \
            -H "Authorization: token ${GITEA_TOKEN}" \
            "${api}/releases/tags/${TAG}" || true)

          if [ -z "$release_json" ]; then
            release_json=$(curl -fsS -X POST \
              -H "Authorization: token ${GITEA_TOKEN}" \
              -H "Content-Type: application/json" \
              "${api}/releases" \
              -d "{\"tag_name\":\"${TAG}\",\"name\":\"${TAG}\",\"target_commitish\":\"${GITHUB_SHA}\"}")
          fi

          release_id=$(python3 -c 'import json,sys; print(json.loads(sys.stdin.read())["id"])' <<< "$release_json")

          existing_assets=$(curl -fsS \
            -H "Authorization: token ${GITEA_TOKEN}" \
            "${api}/releases/${release_id}/assets")

          for chart in "${charts[@]}"; do
            file_name=$(basename "$chart")

            existing_asset_id=$(python3 -c 'import json,sys; assets=json.loads(sys.stdin.read()); name=sys.argv[1]; print(next((str(a["id"]) for a in assets if a.get("name")==name), ""))' "$file_name" <<< "$existing_assets")

            if [ -n "$existing_asset_id" ]; then
              curl -fsS -X DELETE \
                -H "Authorization: token ${GITEA_TOKEN}" \
                "${api}/releases/${release_id}/assets/${existing_asset_id}"
            fi

            curl -fsS -X POST \
              -H "Authorization: token ${GITEA_TOKEN}" \
              -H "Content-Type: application/gzip" \
              --data-binary "@${chart}" \
              "${api}/releases/${release_id}/assets?name=${file_name}"
          done

      - name: Log in to registry
        run: |
          echo "${{ secrets.REGISTRY_PASS }}" | helm registry login registry.kloude.ir \
            --username "${{ secrets.REGISTRY_USER }}" \
            --password-stdin \
            --plain-http

      - name: Push chart to OCI registry
        run: |
          shopt -s nullglob
          charts=(.cr-release-packages/*.tgz)
          if [ ${#charts[@]} -eq 0 ]; then
            echo "No packaged charts to push"
            exit 0
          fi
          for chart in "${charts[@]}"; do
            helm push --plain-http "$chart" "oci://registry.kloude.ir/kloude/kks-provider-plugin-charts"
          done

      - name: Make OCI chart public
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh api --method PATCH "/orgs/kloude/kks-provider-plugin/packages/container/charts%2Fkks-provider-plugin/visibility" -f visibility=public || true