name: Build aether-tunnel

on:
  push:
    tags: ['tunnel-v*']
  workflow_dispatch:

permissions:
  actions: read
  contents: read

concurrency:
  group: build-tunnel-${{ github.ref }}
  cancel-in-progress: false

jobs:
  preflight:
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/')
    steps:
      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5

      - name: Ensure tunnel tag matches Cargo version
        shell: bash
        run: |
          TAG="${GITHUB_REF_NAME}"
          EXPECTED="${TAG#tunnel-v}"
          ACTUAL="$(cargo metadata --manifest-path apps/aether-tunnel/Cargo.toml --locked --no-deps --format-version 1 | jq -r '.packages[] | select(.name == "aether-tunnel") | .version')"

          echo "tag version:   ${EXPECTED}"
          echo "cargo version: ${ACTUAL}"

          if [ -z "${ACTUAL}" ]; then
            echo "Could not resolve aether-tunnel package version" >&2
            exit 1
          fi

          if [ "${EXPECTED}" != "${ACTUAL}" ]; then
            echo "tunnel tag ${TAG} does not match apps/aether-tunnel/Cargo.toml version ${ACTUAL}" >&2
            exit 1
          fi

  build:
    needs: preflight
    if: always() && (needs.preflight.result == 'success' || needs.preflight.result == 'skipped')
    name: ${{ matrix.name }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: linux-amd64
            target: x86_64-unknown-linux-gnu
            os: ubuntu-latest
            use_cross: true
          - name: linux-arm64
            target: aarch64-unknown-linux-gnu
            os: ubuntu-latest
            use_cross: true
          - name: linux-musl-amd64
            target: x86_64-unknown-linux-musl
            os: ubuntu-latest
            use_cross: true
          - name: linux-musl-arm64
            target: aarch64-unknown-linux-musl
            os: ubuntu-latest
            use_cross: true
          - name: macos-amd64
            target: x86_64-apple-darwin
            os: macos-15-intel
            use_cross: false
          - name: macos-arm64
            target: aarch64-apple-darwin
            os: macos-15
            use_cross: false
          - name: windows-amd64
            target: x86_64-pc-windows-msvc
            os: windows-latest
            use_cross: false

    steps:
      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
        with:
          targets: ${{ matrix.target }}

      - name: Ensure Rust target is installed
        run: rustup target add ${{ matrix.target }}

      - name: Rust cache
        uses: Swatinem/rust-cache@49a0bdc70d2e1b713ca9e2869b211fcce03d3c1c # v2
        with:
          workspaces: apps/aether-tunnel -> target
          key: ${{ matrix.target }}

      - name: Install cross
        if: matrix.use_cross
        uses: taiki-e/install-action@1ae7257be536a92d9218a6b343dc6e6ba650f7e1 # cross

      - name: Build
        working-directory: apps/aether-tunnel
        shell: bash
        run: |
          if [ "${{ matrix.use_cross }}" = "true" ]; then
            cross build --release --locked --target ${{ matrix.target }}
          else
            cargo build --release --locked --target ${{ matrix.target }}
          fi

      - name: Package (Unix)
        if: runner.os != 'Windows'
        shell: bash
        run: |
          cd target/${{ matrix.target }}/release
          chmod +x aether-tunnel
          tar czf ../../../aether-tunnel-${{ matrix.name }}.tar.gz aether-tunnel

      - name: Package (Windows)
        if: runner.os == 'Windows'
        shell: bash
        run: |
          cd target/${{ matrix.target }}/release
          7z a ../../../aether-tunnel-${{ matrix.name }}.zip aether-tunnel.exe
          tar czf ../../../aether-tunnel-${{ matrix.name }}.tar.gz aether-tunnel.exe

      - name: Upload artifact
        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
        with:
          name: aether-tunnel-${{ matrix.name }}
          path: |
            aether-tunnel-*.tar.gz
            aether-tunnel-*.zip
          if-no-files-found: error
          retention-days: 1

  release:
    needs: build
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/')
    permissions:
      actions: read
      attestations: write
      contents: write
      id-token: write
    steps:
      - name: Download all artifacts
        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5
        with:
          merge-multiple: true
          path: artifacts

      - name: Generate checksums
        working-directory: artifacts
        run: sha256sum aether-tunnel-* > SHA256SUMS.txt

      - name: Attest tunnel release provenance
        id: attest-release
        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
        with:
          subject-path: |
            artifacts/aether-tunnel-*.tar.gz
            artifacts/aether-tunnel-*.zip
            artifacts/SHA256SUMS.txt

      - name: Bundle tunnel release provenance
        env:
          ATTESTATION_BUNDLE: ${{ steps.attest-release.outputs.bundle-path }}
        run: install -m 0644 "${ATTESTATION_BUNDLE}" artifacts/AETHER_TUNNEL_RELEASE_PROVENANCE.sigstore.json

      - name: Delete stale draft releases for tag
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_TAG: ${{ github.ref_name }}
          REPOSITORY: ${{ github.repository }}
        shell: bash
        run: |
          set -euo pipefail
          draft_ids="$(gh api "repos/${REPOSITORY}/releases" --paginate --jq '.[] | select(.tag_name == env.RELEASE_TAG and .draft == true) | .id')"

          if [[ -z "${draft_ids}" ]]; then
            echo "No stale draft releases for ${RELEASE_TAG}"
            exit 0
          fi

          while IFS= read -r release_id; do
            [[ -z "${release_id}" ]] && continue
            echo "Deleting stale draft release ${release_id} for ${RELEASE_TAG}"
            gh api -X DELETE "repos/${REPOSITORY}/releases/${release_id}"
          done <<< "${draft_ids}"

      - name: Create GitHub Release
        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
        with:
          name: "${{ github.ref_name }}"
          generate_release_notes: true
          files: |
            artifacts/aether-tunnel-*
            artifacts/AETHER_TUNNEL_RELEASE_PROVENANCE.sigstore.json
            artifacts/SHA256SUMS.txt
          fail_on_unmatched_files: true

  update-readme:
    needs: release
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/')
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
        with:
          ref: main

      - name: Update README download links
        env:
          TAG: ${{ github.ref_name }}
        run: |
          VERSION="${TAG#tunnel-v}"
          BASE="https://github.com/fawney19/Aether/releases/download/${TAG}"

          if [ -d apps/aether-tunnel ]; then
            TUNNEL_DIR="apps/aether-tunnel"
          else
            TUNNEL_DIR="aether-tunnel"
          fi

          cd "$TUNNEL_DIR"

          TABLE="| Platform | Download |\n|----------|----------|\n"
          TABLE+="| Linux x86_64 (GNU) | [aether-tunnel-linux-amd64.tar.gz](${BASE}/aether-tunnel-linux-amd64.tar.gz) |\n"
          TABLE+="| Linux ARM64 (GNU) | [aether-tunnel-linux-arm64.tar.gz](${BASE}/aether-tunnel-linux-arm64.tar.gz) |\n"
          TABLE+="| Linux x86_64 (musl) | [aether-tunnel-linux-musl-amd64.tar.gz](${BASE}/aether-tunnel-linux-musl-amd64.tar.gz) |\n"
          TABLE+="| Linux ARM64 (musl) | [aether-tunnel-linux-musl-arm64.tar.gz](${BASE}/aether-tunnel-linux-musl-arm64.tar.gz) |\n"
          TABLE+="| macOS x86_64 | [aether-tunnel-macos-amd64.tar.gz](${BASE}/aether-tunnel-macos-amd64.tar.gz) |\n"
          TABLE+="| macOS ARM64 | [aether-tunnel-macos-arm64.tar.gz](${BASE}/aether-tunnel-macos-arm64.tar.gz) |\n"
          TABLE+="| Windows x86_64 | [aether-tunnel-windows-amd64.zip](${BASE}/aether-tunnel-windows-amd64.zip) |"

          # Replace content between markers
          if grep -q '<!-- DOWNLOAD_TABLE_START -->' README.md; then
            awk -v table="$TABLE" '
              /<!-- DOWNLOAD_TABLE_START -->/ { print; printf "%s\n", table; skip=1; next }
              /<!-- DOWNLOAD_TABLE_END -->/ { skip=0 }
              !skip { print }
            ' README.md > README.tmp && mv README.tmp README.md
          fi

      - name: Commit and push
        run: |
          if [ -d apps/aether-tunnel ]; then
            TUNNEL_DIR="apps/aether-tunnel"
          else
            TUNNEL_DIR="aether-tunnel"
          fi

          cd "$TUNNEL_DIR"
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add README.md
          git diff --cached --quiet && exit 0
          TAG="${GITHUB_REF#refs/tags/}"
          git commit -m "chore(tunnel): update download links for ${TAG}"
          git push