name: Release

permissions:
  contents: read

on:
  push:
    tags:
      - "[0-9]+.[0-9]+.[0-9]+"

jobs:
  guard:
    name: Validate Tag
    runs-on: depot-ubuntu-24.04-arm
    permissions:
      contents: read
    outputs:
      latest: ${{ steps.tag.outputs.latest }}

    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
          persist-credentials: false

      # feature releases must come from master, bugfix releases may come from any
      # branch. only the newest release moves the latest pointers.
      - id: tag
        env:
          MASTER_REF: origin/${{ github.event.repository.default_branch }}
        run: .github/scripts/release-tag.sh "${{ github.ref_name }}" >> "$GITHUB_OUTPUT"

  call-build-workflow:
    needs:
      - guard
    uses: evcc-io/evcc/.github/workflows/default.yml@master
    permissions:
      contents: read
      actions: write

  docker:
    name: Publish Docker :release
    needs:
      - guard
      - call-build-workflow
    runs-on: depot-ubuntu-24.04-arm
    permissions:
      contents: read

    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Login
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
        with:
          username: ${{ secrets.DOCKER_USER }}
          password: ${{ secrets.DOCKER_PASS }}

      - name: Setup Buildx
        id: buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4

      - name: Restore build cache
        uses: ./.github/actions/docker-cache
        with:
          builder: ${{ steps.buildx.outputs.name }}

      - name: Meta
        id: meta
        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6
        with:
          images: |
            evcc/evcc
          # a bugfix release of an older line must not move :latest
          flavor: |
            latest=${{ needs.guard.outputs.latest }}

      - name: Publish
        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7
        with:
          context: .
          platforms: linux/amd64,linux/arm64,linux/arm/v6
          push: true
          build-args: |
            RELEASE=1
          tags: ${{ steps.meta.outputs.tags }}

  apt:
    name: Github & APT
    needs:
      - guard
      - call-build-workflow
    runs-on: depot-ubuntu-24.04-arm

    permissions:
      contents: write
      actions: read

    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Setup Go
        uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
        id: go

      - name: Patch ASN1
        run: make patch-asn1-sudo

      - name: Get dist from cache
        uses: actions/cache/restore@v6
        id: cache-dist
        with:
          path: dist
          key: ${{ runner.os }}-${{ github.sha }}-dist

      # gokrazy image
      # - name: Prepare Image
      #   run: |
      #     make prepare-image
      #     sed -i -e 's#-ld.*$#& -X github.com/evcc-io/evcc/server/updater.Password=${{ secrets.IMAGE_PASS }}#' buildflags/github.com/evcc-io/evcc/buildflags.txt
      #     mkdir /home/runner/.config/gokrazy
      #     echo ${{ secrets.IMAGE_PASS }}> /home/runner/.config/gokrazy/http-password.txt

      # - name: Build Image
      #   run: make image

      # - name: Build Root Filesystem
      #   run: make image-rootfs

      - name: Create Github Release
        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7
        with:
          version: '~> v2'
          args: release --clean
        env:
          # use RELEASE_DEPLOY_TOKEN for access to evcc-io/homebrew-tap
          GITHUB_TOKEN: ${{ secrets.RELEASE_DEPLOY_TOKEN }}
          # a bugfix release of an older line must not move the homebrew formula
          # or the Github latest release marker
          MAKE_LATEST: ${{ needs.guard.outputs.latest }}

      - uses: actions/setup-python@v6
        with:
          python-version: 3.12

      - name: Install Cloudsmith CLI
        run: pip install cloudsmith-cli==1.16.0

      - name: Publish .deb to Cloudsmith
        env:
          CLOUDSMITH_API_KEY: ${{ secrets.CLOUDSMITH_API_KEY }}
        run: make apt-release

  demo:
    name: Demo
    needs:
      - guard
      - docker
    if: needs.guard.outputs.latest == 'true'
    runs-on: depot-ubuntu-24.04-arm

    permissions:
      contents: read

    env:
      FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - uses: superfly/flyctl-actions/setup-flyctl@ed8efb33836e8b2096c7fd3ba1c8afe303ebbff1 # master
      - run: flyctl deploy --local-only --config packaging/fly.toml

  hassio:
    name: Hassio Addon
    needs:
      - guard
      - docker
    if: needs.guard.outputs.latest == 'true'
    runs-on: depot-ubuntu-24.04-arm

    permissions:
      contents: read

    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          repository: evcc-io/hassio-addon
          token: ${{ secrets.HASSIO_DEPLOY_TOKEN }}
          path: ./hassio

      - name: Update version
        run: |
          sed -i -e s#version.*#version\:\ $(echo ${{ github.ref }} | sed -e s#refs/tags/##)# ./hassio/evcc/config.yaml

      - name: Push
        run: |
          cd ./hassio
          git add .
          git config user.name github-actions
          git config user.email github-actions@github.com
          git commit -am "Mirror evcc release"
          git push

  cleanup:
    name: Delete Release Branch
    needs:
      - docker
      - apt
    runs-on: depot-ubuntu-24.04-arm

    permissions:
      contents: write

    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
          persist-credentials: true

      # a bugfix release consumes its release branch, e.g. tag 0.313.1 is the tip
      # of release/0.313.1. Feature releases have no such branch.
      - env:
          TAG: ${{ github.ref_name }}
        run: |
          branch="release/$TAG"

          head=$(git rev-parse --verify --quiet "origin/$branch") || {
            echo "::notice::no $branch to delete"
            exit 0
          }

          if [ "$head" != "$(git rev-parse "$TAG^{commit}")" ]; then
            echo "::notice::$branch moved past $TAG, keeping it"
            exit 0
          fi

          git push origin --delete "$branch"