name: Publish to App Store

# Manual only: pushes an already published v* release to apps.nextcloud.com.
# It does not build anything - it signs the exact tarball build-main.yml
# attached to the Gitea release, because the App Store downloads the file from
# that URL and checks the signature against it. That release only exists if
# the checks were green, so this workflow needs no `needs:` of its own.
#
# Secrets:
#   APPSTORE_PRIVATE_KEY  workflow_deck_automation.key (PEM, the key the App
#                         Store certificate was issued for)
#   APPSTORE_TOKEN        API token from https://apps.nextcloud.com/account/token
on:
  workflow_dispatch:
    inputs:
      tag:
        description: 'Release-Tag, z. B. v35.2.3'
        required: true
        type: string

jobs:
  appstore:
    runs-on: gitea-runner-server03
    permissions:
      contents: read
    env:
      TAG: ${{ inputs.tag }}
      DOWNLOAD_URL: ${{ gitea.server_url }}/${{ gitea.repository }}/releases/download/${{ inputs.tag }}/workflow_deck_automation.tar.gz
    steps:
      - name: Check tag
        run: |
          # latest-main is rebuilt on every push, so its tarball (and signature)
          # would not stay valid - only real version tags go to the store.
          if ! printf '%s' "$TAG" | grep -Eq '^v[0-9]+\.[0-9]+\.[0-9]+$'; then
            echo "::error::'$TAG' is not a version tag (vX.Y.Z)"
            exit 1
          fi

      - name: Download release tarball
        run: |
          # Anonymous on purpose: the App Store fetches this URL without
          # credentials, so a private or missing release has to fail here.
          curl -fsSL "$DOWNLOAD_URL" -o workflow_deck_automation.tar.gz

      - name: Check version in tarball
        run: |
          VERSION=$(tar -xzOf workflow_deck_automation.tar.gz workflow_deck_automation/appinfo/info.xml \
            | sed -n 's:.*<version>\(.*\)</version>.*:\1:p')
          if [ "v$VERSION" != "$TAG" ]; then
            echo "::error::info.xml says version '$VERSION', tag is '$TAG'"
            exit 1
          fi

      - name: Sign and upload
        env:
          PRIVATE_KEY: ${{ secrets.APPSTORE_PRIVATE_KEY }}
          APPSTORE_TOKEN: ${{ secrets.APPSTORE_TOKEN }}
        run: |
          set -e
          if [ -z "$PRIVATE_KEY" ] || [ -z "$APPSTORE_TOKEN" ]; then
            echo "::error::APPSTORE_PRIVATE_KEY and APPSTORE_TOKEN must be set"
            exit 1
          fi

          KEY_FILE=$(mktemp)
          trap 'rm -f "$KEY_FILE"' EXIT
          chmod 600 "$KEY_FILE"
          printf '%s\n' "$PRIVATE_KEY" > "$KEY_FILE"

          # -A keeps the base64 on one line, so it can go into the JSON as is.
          SIGNATURE=$(openssl dgst -sha512 -sign "$KEY_FILE" workflow_deck_automation.tar.gz | openssl base64 -A)

          STATUS=$(curl -sS -o response.json -w '%{http_code}' -X POST \
            -H "Authorization: Token $APPSTORE_TOKEN" \
            -H "Content-Type: application/json" \
            -d "{\"download\":\"$DOWNLOAD_URL\",\"signature\":\"$SIGNATURE\",\"nightly\":false}" \
            https://apps.nextcloud.com/api/v1/apps/releases)

          cat response.json; echo
          # 201 = new release, 200 = existing release replaced
          case "$STATUS" in
            200|201) echo "App Store accepted $TAG (HTTP $STATUS)" ;;
            *) echo "::error::App Store answered HTTP $STATUS"; exit 1 ;;
          esac