#!/usr/bin/env bash
# Check upstream gitea/runner releases and, if a newer version exists than the
# newest gitea-runner ebuild, generate + upload a vendor tarball, bump the
# ebuild, regenerate the Manifest, and open a pull request.
#
# Expects a Gentoo environment with: go, pkgdev, git, curl, xz, jq.
# Required env: BUMP_TOKEN, GITHUB_SERVER_URL, GITHUB_REPOSITORY.
# Optional env: GITHUB_API_URL (defaults to ${GITHUB_SERVER_URL}/api/v1).
#               BUMP_VERSION   target a specific upstream version (X.Y.Z, no
#                              leading "v") instead of the latest release. An
#                              explicit target may be older than the current
#                              ebuild (useful to back out of a broken release).
set -euo pipefail

PN="gitea-runner"
UPSTREAM_RSS="https://gitea.com/gitea/runner/releases.rss"
UPSTREAM_ARCHIVE="https://gitea.com/api/v1/repos/gitea/runner/archive"
UPSTREAM_GOMOD="https://gitea.com/api/v1/repos/gitea/runner/raw/go.mod"
UPSTREAM_TAGS="https://gitea.com/api/v1/repos/gitea/runner/tags"

: "${BUMP_TOKEN:?BUMP_TOKEN is required}"
: "${GITHUB_SERVER_URL:?GITHUB_SERVER_URL is required}"
: "${GITHUB_REPOSITORY:?GITHUB_REPOSITORY is required}"
API="${GITHUB_API_URL:-${GITHUB_SERVER_URL}/api/v1}"

# Preserve the scheme of GITHUB_SERVER_URL — on a Gitea runner this is the
# internal endpoint (e.g. http://172.17.0.1:3000), which speaks plain HTTP.
scheme="${GITHUB_SERVER_URL%%://*}"
host="${GITHUB_SERVER_URL#*://}"
api() { curl -fsSL -H "Authorization: token ${BUMP_TOKEN}" "$@"; }

# --- determine versions ------------------------------------------------------
if [ -n "${BUMP_VERSION:-}" ]; then
  latest="${BUMP_VERSION#v}"
  echo "$latest" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+$' \
    || { echo "BUMP_VERSION must look like X.Y.Z (got '${BUMP_VERSION}')"; exit 1; }
  # Fail fast if the tag doesn't exist upstream, before cloning anything.
  # (The raw endpoint silently falls back to the default branch for an
  # unknown ref, so ask the tags API, which 404s.)
  curl -fsSL "${UPSTREAM_TAGS}/v${latest}" -o /dev/null \
    || { echo "upstream tag v${latest} not found"; exit 1; }
  echo "targeting explicit version ${latest}"
else
  latest=$(curl -fsSL "$UPSTREAM_RSS" \
    | grep -oE '<title>v[0-9]+\.[0-9]+\.[0-9]+</title>' \
    | head -1 | sed -E 's#</?title>##g; s/^v//')
  [ -n "$latest" ] || { echo "could not parse upstream version"; exit 1; }
fi

WORK=$(mktemp -d)
git clone "${scheme}://x-access-token:${BUMP_TOKEN}@${host}/${GITHUB_REPOSITORY}.git" "$WORK"
cd "$WORK"
pkgdir="dev-util/${PN}"

current=$(find "$pkgdir" -name "${PN}-*.ebuild" \
  | sed -E "s#.*/${PN}-(.*)\.ebuild#\1#" | sort -V | tail -1)
echo "upstream=${latest} current=${current}"

[ "$latest" != "$current" ] || { echo "already at ${latest}"; exit 0; }
newest=$(printf '%s\n%s\n' "$current" "$latest" | sort -V | tail -1)
if [ "$newest" = "$current" ]; then
  if [ -n "${BUMP_VERSION:-}" ]; then
    echo "warning: explicit target ${latest} is older than current ${current}; downgrading"
  else
    echo "current ($current) is newer than upstream ($latest); nothing to do"; exit 0
  fi
fi

branch="bump/${PN}-${latest}"
if api "${API}/repos/${GITHUB_REPOSITORY}/branches/${branch}" >/dev/null 2>&1; then
  echo "branch ${branch} already exists; nothing to do"; exit 0
fi

echo "bumping ${PN}: ${current} -> ${latest}"

# --- generate + upload the vendor tarball ------------------------------------
dist=$(mktemp -d)
curl -fsSL "${UPSTREAM_ARCHIVE}/v${latest}.tar.gz" -o "${dist}/${PN}-${latest}.tar.gz"
tar xzf "${dist}/${PN}-${latest}.tar.gz" -C "$dist"
( cd "${dist}/runner" && go mod vendor )
XZ_OPT=-9 tar --sort=name --mtime='UTC 1970-01-01' --owner=0 --group=0 --numeric-owner \
  --create --auto-compress --file "${dist}/${PN}-${latest}-vendor.tar.xz" \
  -C "$dist" runner/vendor

vendor_tag="${PN}-${latest}-vendor"
rel_id=$(api "${API}/repos/${GITHUB_REPOSITORY}/releases/tags/${vendor_tag}" 2>/dev/null \
  | jq -r '.id // empty' || true)
if [ -z "$rel_id" ]; then
  rel_id=$(api -X POST -H 'Content-Type: application/json' \
    "${API}/repos/${GITHUB_REPOSITORY}/releases" \
    -d "{\"tag_name\":\"${vendor_tag}\",\"target_commitish\":\"master\",\"name\":\"${vendor_tag}\",\"body\":\"Vendored Go modules for ${PN} ${latest}.\"}" \
    | jq -r '.id')
fi
api -X POST -H 'Content-Type: multipart/form-data' \
  -F "attachment=@${dist}/${PN}-${latest}-vendor.tar.xz" \
  "${API}/repos/${GITHUB_REPOSITORY}/releases/${rel_id}/assets?name=${PN}-${latest}-vendor.tar.xz" \
  >/dev/null

# --- bump the ebuild ---------------------------------------------------------
git config user.name "gitea-actions"
git config user.email "actions@azy.dev"
git checkout -b "$branch"
git mv "${pkgdir}/${PN}-${current}.ebuild" "${pkgdir}/${PN}-${latest}.ebuild"

# Track the upstream go.mod's required Go version in BDEPEND.
goreq=$(curl -fsSL "${UPSTREAM_GOMOD}?ref=v${latest}" \
  | grep -oE '^go [0-9]+\.[0-9]+(\.[0-9]+)?' | awk '{print $2}')
[ -n "$goreq" ] && sed -i -E \
  "s#^BDEPEND=\">=dev-lang/go-[0-9.]+\"#BDEPEND=\">=dev-lang/go-${goreq}\"#" \
  "${pkgdir}/${PN}-${latest}.ebuild"

# Regenerate the Manifest (pkgdev fetches distfiles into DISTDIR first).
mkdir -p /var/cache/distfiles
cp "${dist}/${PN}-${latest}.tar.gz" /var/cache/distfiles/
cp "${dist}/${PN}-${latest}-vendor.tar.xz" /var/cache/distfiles/
mkdir -p /etc/portage/repos.conf
printf '[DEFAULT]\nmain-repo = gentoo\n\n[gentoo]\nlocation = /var/db/repos/gentoo\n' \
  > /etc/portage/repos.conf/gentoo.conf
printf '[azy5030]\nlocation = %s\nmasters = gentoo\nauto-sync = false\n' "$WORK" \
  > /etc/portage/repos.conf/azy5030.conf
( cd "${pkgdir}" && pkgdev manifest )

# --- validate, commit, push, open PR ----------------------------------------
pkgcheck scan --repo "$WORK" "${pkgdir}" || true
mkdir -p /etc/portage/package.accept_keywords
echo 'dev-util/gitea-runner ~amd64' > /etc/portage/package.accept_keywords/gitea-runner
emerge -v --getbinpkg "=dev-util/${PN}-${latest}"
gitea-runner --version | grep -q "v${latest}"

git add -A
git commit -m "dev-util/${PN}: bump to ${latest}"
git push origin "$branch"

body=$(cat <<EOF
Automated bump of \`dev-util/${PN}\` from ${current} to ${latest}.

- Upstream release: https://gitea.com/gitea/runner/releases/tag/v${latest}
- Vendor tarball: https://git.azy.dev/${GITHUB_REPOSITORY}/releases/tag/${vendor_tag}

Review checklist:
- [ ] LICENSE still covers all vendored module licenses (\`go-licenses report ./...\`)
- [ ] BDEPEND Go version matches upstream go.mod (set to >=${goreq:-unchanged})
- [ ] version ldflags path \`internal/pkg/ver.version\` unchanged upstream

CI build + \`gitea-runner --version\` passed in this workflow.
EOF
)
api -X POST -H 'Content-Type: application/json' \
  "${API}/repos/${GITHUB_REPOSITORY}/pulls" \
  -d "$(jq -n --arg h "$branch" --arg t "dev-util/${PN}: bump to ${latest}" --arg b "$body" \
    '{head:$h, base:"master", title:$t, body:$b}')" \
  | jq -r '"opened PR #\(.number): \(.html_url)"'