name: Publish launcher release status

on:
  # Manual-release mode is active. Restore the status-file push trigger when
  # automatic channel/history publication is wanted again.
  workflow_dispatch:

concurrency:
  group: launcher-release-publication
  cancel-in-progress: false

jobs:
  history:
    name: Sign and publish release history
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: write

    steps:
      - name: Check out trusted release metadata
        uses: actions/checkout@v4
        with:
          ref: ${{ github.ref }}

      - name: Validate release status configuration
        shell: bash
        run: |
          set -euo pipefail
          for command in git bash curl jq python3 openssl base64 realpath stat
          do
            command -v "$command" >/dev/null || {
              printf 'Required metadata command is unavailable: %s\n' "$command" >&2
              exit 1
            }
          done
          python3 -c 'import sys; raise SystemExit(0 if sys.version_info >= (3, 11) else 1)'
          python3 -m compileall -q ptlinux scripts
          python3 scripts/generate_history.py --help >/dev/null
          bash -n scripts/publish-release-history.sh

      - name: Materialize the protected manifest signing key
        shell: bash
        env:
          MANIFEST_SIGNING_KEY: ${{ secrets.MANIFEST_SIGNING_KEY }}
        run: |
          set -euo pipefail
          if [[ -z "${MANIFEST_SIGNING_KEY:-}" ]]
          then
            printf '%s\n' 'MANIFEST_SIGNING_KEY is required for metadata publication.' >&2
            exit 1
          fi
          umask 077
          SIGNING_KEY_FILE="${RUNNER_TEMP}/launcher-manifest-signing-key.pem"
          printf '%s\n' "$MANIFEST_SIGNING_KEY" > "$SIGNING_KEY_FILE"
          chmod 0600 "$SIGNING_KEY_FILE"
          printf 'PTLINUX_SIGNING_KEY=%s\n' "$SIGNING_KEY_FILE" >> "$GITHUB_ENV"

      - name: Publish signed release status and history
        shell: bash
        env:
          RELEASE_BRANCH: main
          RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
        run: |
          set -euo pipefail
          ./scripts/publish-release-history.sh ./dist/status

      - name: Remove signing key
        if: always()
        shell: bash
        run: |
          if [[ -n "${PTLINUX_SIGNING_KEY:-}" ]]
          then
            rm -f -- "$PTLINUX_SIGNING_KEY"
          fi