name: netbird-slate7-release

# Prüft auf neue NetBird-Versionen und spiegelt das arm64-Binary als Gitea-Release,
# von dem der GL.iNet Slate 7 per Ein-Zeiler installiert/upgradet.
on:
  schedule:
    - cron: '17 4 * * *'        # täglich 04:17 UTC: auf neue NetBird-Version prüfen
  workflow_dispatch:
    inputs:
      force:
        description: 'Release neu bauen, auch wenn die Version schon existiert'
        required: false
        default: 'false'
  push:
    branches: [main]
    paths:
      - '.gitea/workflows/release.yml'

permissions:
  contents: write

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - name: NetBird-Version ermitteln
        id: ver
        run: |
          set -eu
          VER=$(curl -fsSL https://api.github.com/repos/netbirdio/netbird/releases/latest \
                | grep -o '"tag_name":[^,]*' | head -1 | grep -o '[0-9][0-9.]*' | head -1)
          test -n "$VER"
          echo "ver=$VER" >> "$GITHUB_OUTPUT"
          echo "tag=v$VER" >> "$GITHUB_OUTPUT"
          echo "NetBird latest: $VER"

      - name: Vorhandenes Release prüfen
        id: check
        run: |
          set -eu
          API="${{ github.server_url }}/api/v1/repos/${{ github.repository }}"
          CODE=$(curl -s -o /dev/null -w '%{http_code}' \
                 -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
                 "$API/releases/tags/${{ steps.ver.outputs.tag }}")
          echo "Tag ${{ steps.ver.outputs.tag }} -> HTTP $CODE"
          if [ "$CODE" = "200" ] && [ "${{ github.event.inputs.force }}" != "true" ]; then
            echo "skip=true" >> "$GITHUB_OUTPUT"
            echo "Release existiert bereits -> nichts zu tun."
          else
            echo "skip=false" >> "$GITHUB_OUTPUT"
          fi

      - name: NetBird arm64 holen + Checksumme
        if: steps.check.outputs.skip != 'true'
        run: |
          set -eu
          V="${{ steps.ver.outputs.ver }}"
          F="netbird_${V}_linux_arm64.tar.gz"
          curl -fsSL -o "$F" "https://github.com/netbirdio/netbird/releases/download/v${V}/${F}"
          # Plausibilität: enthält das Tarball das netbird-Binary?
          tar -tzf "$F" | grep -qx netbird
          sha256sum "$F" | tee "${F}.sha256"
          ls -l "$F"

      - name: Gitea-Release anlegen + Assets hochladen
        if: steps.check.outputs.skip != 'true'
        env:
          GT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          API_BASE: ${{ github.server_url }}/api/v1/repos/${{ github.repository }}
          REPO: ${{ github.repository }}
          SERVER: ${{ github.server_url }}
          VER: ${{ steps.ver.outputs.ver }}
          TAG: ${{ steps.ver.outputs.tag }}
          FORCE: ${{ github.event.inputs.force }}
        run: |
          set -eu
          F="netbird_${VER}_linux_arm64.tar.gz"
          # bei force: altes Release + Tag entfernen, damit Assets nicht kollidieren
          if [ "${FORCE:-false}" = "true" ]; then
            RID=$(curl -s -H "Authorization: token $GT_TOKEN" "$API_BASE/releases/tags/$TAG" | grep -o '"id":[0-9]*' | head -1 | grep -o '[0-9]*' || true)
            if [ -n "${RID:-}" ]; then
              curl -s -X DELETE -H "Authorization: token $GT_TOKEN" "$API_BASE/releases/$RID" >/dev/null || true
              curl -s -X DELETE -H "Authorization: token $GT_TOKEN" "$API_BASE/tags/$TAG"     >/dev/null || true
            fi
          fi
          # Release-Body als JSON via printf (NOTES: nur ASCII, keine " und kein % -> kein Escaping-Problem)
          NOTES="Automatischer NetBird-Deploy fuer GL.iNet Slate 7 (aarch64).\n\n- NetBird-Version: ${VER}\n- Server: https://nb.digiflo.at:443\n\nInstallieren / Upgraden auf dem Router (als root):\n\n    wget -qO- ${SERVER}/${REPO}/raw/branch/main/install-netbird-slate7.sh | sh\n\nErstinstallation inkl. Enrollment:\n\n    wget -qO /tmp/nb.sh ${SERVER}/${REPO}/raw/branch/main/install-netbird-slate7.sh && sh /tmp/nb.sh DEIN-SETUP-KEY\n"
          printf '{"tag_name":"%s","target_commitish":"main","name":"NetBird %s (Slate 7)","body":"%s","draft":false,"prerelease":false}' "$TAG" "$VER" "$NOTES" > /tmp/body.json
          RID=$(curl -fsSL -X POST -H "Authorization: token $GT_TOKEN" -H "Content-Type: application/json" \
                -d @/tmp/body.json "$API_BASE/releases" | grep -o '"id":[0-9]*' | head -1 | grep -o '[0-9]*')
          test -n "$RID"
          echo "Release-ID: $RID"
          for A in "$F" "${F}.sha256"; do
            curl -fsSL -X POST -H "Authorization: token $GT_TOKEN" \
                 -F "attachment=@${A};type=application/octet-stream" \
                 "$API_BASE/releases/$RID/assets?name=${A}" >/dev/null
            echo "Asset hochgeladen: $A"
          done
          echo "FERTIG: $TAG veroeffentlicht."