name: release

# Bygger fristående npmctl-binärer för linux-arm64 (native på Pi-runnern) och
# linux-x64 (cross via gcc-x86-64-linux-gnu) och publicerar dem som assets på
# en Gitea-release. Runnern använder sin egen GITHUB_TOKEN mot Gitea-API:t —
# ingen token behöver hanteras manuellt.
on:
  push:
    branches: [main, master]      # varje main-push -> rullande 'latest'-release
    tags: ["v*"]                  # vX.Y.Z -> versionerad release
  workflow_dispatch:
    inputs:
      tag:
        description: "Release-tag (lämna tom för 'latest')"
        required: false

jobs:
  build-release:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Bestäm tag
        id: t
        run: |
          case "$GITHUB_REF" in
            refs/tags/*) T="$GITHUB_REF_NAME" ;;
            *) T="${{ inputs.tag }}"; [ -z "$T" ] && T="latest" ;;
          esac
          echo "tag=$T" >> "$GITHUB_OUTPUT"
          echo "bygger release: $T"

      - name: Installera toolchain + bygg binärer
        run: |
          set -eux
          SUDO=""; [ "$(id -u)" -ne 0 ] && SUDO=sudo
          $SUDO apt-get update
          # gcc: native (arm64) C-compiler för ring. gcc-x86-64-linux-gnu + libc6-dev-amd64-cross:
          # cross-compiler OCH x86_64-målets libc-headers/-libs (annars hittar cross-gcc:n
          # inte bits/libc-header-start.h när ring:s C-kod byggs).
          $SUDO apt-get install -y --no-install-recommends \
            gcc gcc-x86-64-linux-gnu libc6-dev-amd64-cross jq curl ca-certificates

          # Rust (om det saknas på runnern).
          if ! command -v cargo >/dev/null 2>&1; then
            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal
          fi
          . "$HOME/.cargo/env"

          rustup target add aarch64-unknown-linux-gnu x86_64-unknown-linux-gnu

          mkdir -p dist

          # arm64 — native på Pi-runnern.
          cargo build --release --target aarch64-unknown-linux-gnu
          cp target/aarch64-unknown-linux-gnu/release/npmctl dist/npmctl-linux-arm64

          # x64 — cross. Peka ut cross-linker och C-compiler (för ring).
          export CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_LINKER=x86_64-linux-gnu-gcc
          export CC_x86_64_unknown_linux_gnu=x86_64-linux-gnu-gcc
          export AR_x86_64_unknown_linux_gnu=x86_64-linux-gnu-ar
          cargo build --release --target x86_64-unknown-linux-gnu
          cp target/x86_64-unknown-linux-gnu/release/npmctl dist/npmctl-linux-x64

          cp install.sh dist/install.sh
          cd dist
          sha256sum npmctl-linux-* install.sh > checksums.txt
          ls -la

      - name: Skapa Gitea-release + ladda upp assets
        env:
          API: http://gitea-d:3000/api/v1
          REPO: ${{ github.repository }}
          TAG: ${{ steps.t.outputs.tag }}
          TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -eu
          B=dist
          BODY=$(cat <<'MD'
`npmctl` — CLI för Nginx Proxy Manager (NPM) med sudo-liknande token-auth (lösenordet sparas aldrig, bara en kortlivad token) och en generisk `api`-funktion för vilket HTTP-API som helst.

**Installera (en rad):**
```
curl -fsSL https://gitea.brasse-pc.eu/brasse/Npm-cli/raw/branch/main/install.sh | sh
```

Eller ladda ner rätt binär nedan (`npmctl-linux-x64` / `npmctl-linux-arm64`), `chmod +x` och lägg i PATH. Verifiera mot `checksums.txt`.

📖 Guide: https://gitea.brasse-pc.eu/brasse/Npm-cli/wiki
MD
)
          payload=$(jq -n --arg tag "$TAG" --arg body "$BODY" '{tag_name:$tag,name:$tag,body:$body}')
          rid=$(curl -s -X POST "$API/repos/$REPO/releases" -H "Authorization: token $TOKEN" -H 'Content-Type: application/json' -d "$payload" | jq -r '.id // empty')
          [ -z "$rid" ] && rid=$(curl -s "$API/repos/$REPO/releases/tags/$TAG" -H "Authorization: token $TOKEN" | jq -r '.id')
          echo "release id: $rid"
          # Uppdatera namn/beskrivning även om releasen redan fanns (rullande 'latest').
          curl -s -X PATCH "$API/repos/$REPO/releases/$rid" -H "Authorization: token $TOKEN" -H 'Content-Type: application/json' \
            -d "$(jq -n --arg tag "$TAG" --arg body "$BODY" '{name:$tag,body:$body}')" -o /dev/null
          for f in npmctl-linux-x64 npmctl-linux-arm64 install.sh checksums.txt; do
            aid=$(curl -s "$API/repos/$REPO/releases/$rid/assets" -H "Authorization: token $TOKEN" | jq -r ".[] | select(.name==\"$f\") | .id")
            if [ -n "$aid" ] && [ "$aid" != "null" ]; then
              echo "ersätter befintlig $f (id $aid)"
              curl -s -X DELETE "$API/repos/$REPO/releases/$rid/assets/$aid" -H "Authorization: token $TOKEN" -o /dev/null
            fi
            echo "laddar upp $f ..."
            curl -s -X POST "$API/repos/$REPO/releases/$rid/assets?name=$f" -H "Authorization: token $TOKEN" -F "attachment=@$B/$f" -o /dev/null -w "  -> HTTP %{http_code}\n"
          done