set -euo pipefail

version="$(printf '%s' "${VERSION_INPUT}" | tr -d ' \t\r\n')"
if [ -z "${version}" ]; then
  echo "::error::version input is empty"
  exit 1
fi
if [ "${version#v}" != "${version}" ]; then
  echo "::error::Do not include the leading 'v'. Pass '${version#v}', not '${version}'."
  exit 1
fi
if ! printf '%s' "${version}" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$'; then
  echo "::error::version must be MAJOR.MINOR.PATCH (e.g. 1.2.3), got '${version}'"
  exit 1
fi
tag="v${version}"

# Normalise the boolean input to an unambiguous string output;
# step outputs are always strings, so `!= 'true'` is safe downstream.
dry_run=false
case "$(printf '%s' "${DRY_RUN_INPUT}" | tr '[:upper:]' '[:lower:]')" in
  true|1|yes|on) dry_run=true ;;
esac

# Cross-check the VERSION file. A mismatch is usually a forgotten bump
# PR; it is a warning, not a hard failure, so hotfixes stay possible.
if [ -f VERSION ]; then
  base="$(tr -d ' \t\r\n' < VERSION)"
  if [ "${base}" != "${version}" ]; then
    echo "::warning::VERSION file says '${base}' but you are releasing '${version}'." \
         "Open a PR bumping VERSION to '${version}' so future RCs are numbered from it."
  fi
else
  echo "::warning::No VERSION file at the repository root."
fi

{
  echo "version=${version}"
  echo "tag=${tag}"
  echo "dry_run=${dry_run}"
} >> "$GITHUB_OUTPUT"

echo "Releasing ${tag} at ${GITHUB_SHA} (dry_run=${dry_run})"

set -euo pipefail

# 1. Local/remote git tag — authoritative and always available.
git fetch --tags --force --quiet || true
if git rev-parse -q --verify "refs/tags/${TAG}" >/dev/null 2>&1; then
  echo "::error::Tag ${TAG} already exists. Bump the version instead of re-releasing."
  exit 1
fi
if git ls-remote --exit-code --tags origin "refs/tags/${TAG}" >/dev/null 2>&1; then
  echo "::error::Tag ${TAG} already exists on the remote."
  exit 1
fi

# 2. Release API — best effort. $GITHUB_API_URL already carries the
#    /gh prefix of the rickub REST shim. Anything other than a clear
#    200 is treated as "cannot tell" so a shim/proxy hiccup does not
#    block a legitimate release (the git tag check above is the gate).
code="$(curl -sS -o /tmp/release-probe.json -w '%{http_code}' \
  -H "Authorization: Bearer ${GH_TOKEN}" \
  -H "Accept: application/vnd.github+json" \
  "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/releases/tags/${TAG}" || echo 000)"
case "${code}" in
  200)
    echo "::error::A release for ${TAG} already exists (API returned 200)."
    exit 1
    ;;
  404)
    echo "No existing release for ${TAG}."
    ;;
  *)
    echo "::warning::Could not check for an existing ${TAG} release (HTTP ${code});" \
         "relying on the git tag check. A 403 here means the CI proxy still blocks" \
         "/gh paths — see RELEASING.md."
    ;;
esac

go vet ./...

go test ./... -count=1

bash scripts/build-dist.sh "${{ steps.check.outputs.version }}"

set -euo pipefail
{
  echo "## rickub ${TAG}"
  echo
  echo "- Commit: \`${GITHUB_SHA}\` (\`${GITHUB_REF_NAME}\`)"
  echo "- Built by \`${WORKFLOW}\` run #${GITHUB_RUN_NUMBER}"
  echo
  echo '### Install'
  echo
  echo 'Download the archive for your platform, verify it, and drop the binary on your PATH:'
  echo
  echo '```sh'
  echo "v=${TAG#v}"
  echo "os=\$(uname -s | tr '[:upper:]' '[:lower:]')"
  echo "arch=\$(uname -m); case \"\$arch\" in x86_64) arch=amd64 ;; aarch64) arch=arm64 ;; esac"
  echo "base=\${RICKUB_GITHUB_SERVER_URL:-https://rickub.com}/${GITHUB_REPOSITORY}/releases/download/${TAG}"
  echo 'curl -fsSLO "$base/rickub_${v}_${os}_${arch}.tar.gz" && curl -fsSLO "$base/SHA256SUMS"'
  echo 'sha256sum -c SHA256SUMS --ignore-missing   # shasum -a 256 -c on macOS'
  echo 'tar -xzf "rickub_${v}_${os}_${arch}.tar.gz" rickub'
  echo 'install -m 0755 rickub /usr/local/bin/rickub'
  echo '```'
  echo
  echo '### Checksums'
  echo
  echo '```'
  cat dist/SHA256SUMS
  echo '```'
} > "${RUNNER_TEMP}/release-notes.md"
echo "path=${RUNNER_TEMP}/release-notes.md" >> "$GITHUB_OUTPUT"

set -euo pipefail
echo "::notice::Dry run — ${{ steps.check.outputs.tag }} was NOT published."
echo "Artifacts that would have been released:"
ls -l dist/