name: Bump
on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
    inputs:
      version:
        description: >-
          Upstream gitea/runner version to bump to (e.g. 3.4.0, no leading
          "v"). Leave empty to use the latest upstream release.
        required: false
        type: string

jobs:
  bump:
    runs-on: ubuntu-latest
    container:
      image: gentoo/stage3:amd64-openrc
    steps:
      # Cheap gate: compare the newest upstream release against the newest
      # committed ebuild using only base-image tools (wget). The expensive
      # toolchain install + bump below is skipped on the common no-op day, so a
      # daily run that has nothing to do finishes in seconds instead of minutes.
      # bump-version.sh re-checks this itself and remains the source of truth.
      - name: Check whether a bump is needed
        id: check
        env:
          BUMP_TOKEN: ${{ secrets.BUMP_TOKEN }}
          BUMP_VERSION: ${{ inputs.version }}
        run: |
          # An explicitly requested version always runs the full bump.
          if [ -n "${BUMP_VERSION}" ]; then
            echo "needed=true" >> "$GITHUB_OUTPUT"
            echo "explicit version requested: ${BUMP_VERSION}"
            exit 0
          fi
          latest=$(wget -qO- https://gitea.com/gitea/runner/releases.rss \
            | grep -oE '<title>v[0-9]+\.[0-9]+\.[0-9]+</title>' \
            | head -1 | sed -E 's#</?title>##g; s/^v//')
          current=$(wget -qO- --header="Authorization: token ${BUMP_TOKEN}" \
            "${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}/contents/dev-util/gitea-runner" \
            | grep -oE '"name": *"gitea-runner-[0-9.]+\.ebuild"' \
            | sed -E 's#.*gitea-runner-([0-9.]+)\.ebuild.*#\1#' | sort -V | tail -1)
          echo "upstream=${latest} current=${current}"
          # Only short-circuit when we are CONFIDENT there is nothing to do
          # (both versions parsed and current is >= upstream). On any doubt
          # fall through to the full run and let bump-version.sh decide.
          if [ -n "$latest" ] && [ -n "$current" ] \
             && [ "$(printf '%s\n%s\n' "$current" "$latest" | sort -V | tail -1)" = "$current" ]; then
            echo "needed=false" >> "$GITHUB_OUTPUT"
            echo "nothing to do (upstream ${latest}, have ${current})"
          else
            echo "needed=true" >> "$GITHUB_OUTPUT"
          fi

      - name: Sync ::gentoo
        if: steps.check.outputs.needed == 'true'
        run: emerge-webrsync

      - name: Configure portage + install tooling
        if: steps.check.outputs.needed == 'true'
        run: |
          mkdir -p /etc/portage/repos.conf
          printf '[DEFAULT]\nmain-repo = gentoo\n\n[gentoo]\nlocation = /var/db/repos/gentoo\n' \
            > /etc/portage/repos.conf/gentoo.conf
          sed -i '/^verify-signature/d' /etc/portage/binrepos.conf/gentoo.conf
          printf '\nverify-signature = false\n' >> /etc/portage/binrepos.conf/gentoo.conf
          # Upstream's go.mod can require a Go that Gentoo only has under
          # ~amd64 (GOTOOLCHAIN=local forbids auto-download), so accept the
          # testing-keyworded dev-lang/go. It is built from source when no
          # stable binpkg satisfies the requirement.
          mkdir -p /etc/portage/package.accept_keywords
          echo 'dev-lang/go ~amd64' > /etc/portage/package.accept_keywords/go
          emerge -q --getbinpkg \
            dev-vcs/git net-misc/curl app-arch/xz-utils app-misc/jq \
            dev-lang/go dev-util/pkgdev

      - name: Check for new release and open PR
        if: steps.check.outputs.needed == 'true'
        env:
          BUMP_TOKEN: ${{ secrets.BUMP_TOKEN }}
          BUMP_VERSION: ${{ inputs.version }}
        run: |
          host=${GITHUB_SERVER_URL#http://}; host=${host#https://}
          curl -fsSL "http://x-access-token:${BUMP_TOKEN}@${host}/${GITHUB_REPOSITORY}/raw/branch/master/scripts/bump-version.sh" \
            -o /tmp/bump-version.sh
          bash /tmp/bump-version.sh