# PUBLISH TO PREVIEW: THE BUILT FILE, TO THE CANARY CHANNEL.
#
# "Preview" is the canary channel on updates.riverofglorymn.org under a
# friendlier name; the URL and the laptop's device.conf are unchanged.
#
# Two jobs, so that no job has both the update server's key and Docker:
#
#   gate     on ekklesia-ci: the full container gate, again, on the file
#            the Gitea release holds, against what canary and stable
#            serve right now. No secret.
#   publish  on ekklesia-release: update_canary.sh publishes that same
#            file on that gate's report — it refuses a report for other
#            bytes, or one made before canary or stable moved — then reads
#            everything back over HTTPS and records it on the release.
#
# Never automatic. Nothing publishes because a branch was pushed.
name: Release 2 - publish to Preview (canary)

on:
  workflow_dispatch:
    inputs:
      version:
        description: 'The version, as built by "Release 1 - build"'
        required: true
      sha256:
        description: 'Its SHA-256, from that release: nothing else is published'
        required: true
      from_versions:
        description: 'Older releases rooms are still on, rehearsed as upgrades too (e.g. 0.2.2)'
        required: false
        default: ''

jobs:
  gate:
    name: gate the release's file
    runs-on: ekklesia-ci
    outputs:
      report: ${{ steps.gate.outputs.report }}
    steps:
      - uses: actions/checkout@v4

      - name: The container gate, on exactly that file
        id: gate
        env:
          VERSION: ${{ github.event.inputs.version }}
          SHA256: ${{ github.event.inputs.sha256 }}
          RELEASE_GATE_FROM: ${{ github.event.inputs.from_versions }}
          GITEA_TOKEN: ${{ secrets.RELEASE_API_TOKEN || github.token }}
        run: RELEASE_CI_WORK="$RUNNER_TEMP/release" tools/release-ci.sh gate "$VERSION" "$SHA256"

  publish:
    name: publish to canary and read it back
    needs: gate
    runs-on: ekklesia-release
    steps:
      - uses: actions/checkout@v4

      - name: What publishing needs
        run: |
          command -v ssh rsync curl python3 dpkg-deb git >/dev/null \
            || { apt-get update -qq && apt-get install -y -qq --no-install-recommends \
                   openssh-client rsync curl python3 dpkg git ca-certificates >/dev/null; }

      - name: Publish, on the gate's report, and record it
        env:
          VERSION: ${{ github.event.inputs.version }}
          SHA256: ${{ github.event.inputs.sha256 }}
          REPORT: ${{ needs.gate.outputs.report }}
          GITEA_TOKEN: ${{ secrets.RELEASE_API_TOKEN || github.token }}
          RELEASE_SSH_KEY: ${{ secrets.CLASSROOM_UPDATES_SSH_KEY }}
          RELEASE_SSH_KNOWN_HOSTS: ${{ vars.CLASSROOM_UPDATES_KNOWN_HOSTS }}
          RELEASE_SSH_ADDRESS: ${{ vars.CLASSROOM_UPDATES_ADDRESS }}
          RELEASE_SSH_USER: ${{ vars.CLASSROOM_UPDATES_USER }}
        run: RELEASE_CI_WORK="$RUNNER_TEMP/release" tools/release-ci.sh preview "$VERSION" "$SHA256" "$REPORT"