# CASAN release — build split bundles + publish to the Gitea package registry.
# Triggers on a version tag (vX.Y.Z). Verifies the gate, builds core/devkit/platform/
# all-in-one-demo, and uploads each artifact to the Gitea generic package registry.
# Enterprise (Level 4) is intentionally skipped (package-release.sh refuses it).
#
# Requires repo/org secret: GITEA_TOKEN  (scope: write:package).
name: CASAN Release

on:
  push:
    tags:
      - 'v*'

jobs:
  release:
    runs-on: ci-runner
    timeout-minutes: 60
    env:
      CASAN_CI_RUN_FRONTEND: "0"
      CASAN_CI_RUN_BACKEND: "0"
      CASAN_CI_RUN_CONTROL_PANEL: "1"
      CASAN_CI_RUN_INFRA_LAB: "0"
      CASAN_CI_STEP_TIMEOUT_SEC: "1200"
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Toolchain
        run: |
          set -euo pipefail
          command -v python3 >/dev/null || { apt-get update && apt-get install -y python3; }
          command -v curl >/dev/null || { apt-get update && apt-get install -y curl; }
          python3 --version

      - name: Tag must match VERSION
        run: |
          set -euo pipefail
          TAG="${GITHUB_REF_NAME#v}"
          FILE_VER="$(cat VERSION)"
          echo "tag=$TAG version-file=$FILE_VER"
          [ "$TAG" = "$FILE_VER" ] || { echo "::error::tag v$TAG != VERSION $FILE_VER — bump VERSION before tagging"; exit 1; }

      - name: Install locked Node dependencies
        run: npm ci

      - name: Verify governance gate (must be green to release)
        run: bash packages/casan-harness/scripts/bash/ci-harness-gate.sh

      - name: Build split bundles
        run: |
          set -euo pipefail
          for b in core devkit platform all-in-one-demo; do
            scripts/package-release.sh "$b"
          done
          # enterprise is future → refused on purpose; do not fail the release
          scripts/package-release.sh enterprise || echo "enterprise skipped (future, expected)"
          ls -lh dist/

      - name: Smoke extracted release artifacts
        run: |
          set -euo pipefail
          scripts/smoke-release-artifact.sh "dist/casan-core-v$(cat VERSION).tar.gz"
          scripts/smoke-release-artifact.sh "dist/casan-devkit-v$(cat VERSION).tar.gz"
          CASAN_ARTIFACT_SMOKE_RUN_TESTS=1 \
            scripts/smoke-release-artifact.sh "dist/casan-platform-preview-v$(cat VERSION).tar.gz"

      - name: Publish bundles to Gitea package registry
        env:
          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
        run: |
          set -euo pipefail
          [ -n "${GITEA_TOKEN:-}" ] || { echo "::error::secret GITEA_TOKEN not set (scope write:package)"; exit 1; }
          BASE="${GITHUB_SERVER_URL:-http://localhost:3000}"
          OWNER="${GITHUB_REPOSITORY_OWNER:-admin}"
          V="$(cat VERSION)"
          publish() {  # <artifact-path> <package-name> <pkg-version>
            local f="$1" name="$2" ver="$3"
            echo "→ $BASE/api/packages/$OWNER/generic/$name/$ver/$(basename "$f")"
            curl -fsSL -X PUT -H "Authorization: token $GITEA_TOKEN" \
              --upload-file "$f" \
              "$BASE/api/packages/$OWNER/generic/$name/$ver/$(basename "$f")"
            curl -fsSL -X PUT -H "Authorization: token $GITEA_TOKEN" \
              --upload-file "$f.sha256" \
              "$BASE/api/packages/$OWNER/generic/$name/$ver/$(basename "$f").sha256"
          }
          publish "dist/casan-core-v$V.tar.gz"            casan-core    "$V"
          publish "dist/casan-devkit-v$V.tar.gz"          casan-devkit  "$V"
          publish "dist/casan-platform-preview-v$V.tar.gz" casan-platform "$V-preview"
          publish "dist/casan-all-in-one-demo-v$V.tar.gz" casan-all-in-one-demo "$V"
          echo "Published core, devkit, platform(preview), all-in-one-demo to $BASE (owner=$OWNER, v=$V)."