# PROMOTE TO STABLE: THE FILE PREVIEW RAN, AND NOTHING ELSE.
#
# Only after a person has done the physical checks in docs/testing.md on
# real hardware and says so here. No build, no gate: stable is pointed at
# the package already on the server, and update_stable.sh refuses any
# file but the SHA-256 given. The Gitea release must already record that
# exact file going to Preview.
#
# Merging code never runs this. Nothing runs it but a person.
name: Release 3 - promote to Stable

on:
  workflow_dispatch:
    inputs:
      version:
        description: 'The version on Preview to promote'
        required: true
      sha256:
        description: 'Its SHA-256, exactly as approved'
        required: true
      approval:
        description: 'Who approved it, when, and which physical checks passed on which machine'
        required: true
      confirm:
        description: 'Type: PROMOTE <version> TO STABLE'
        required: true

jobs:
  promote:
    name: promote the approved file and read it back
    runs-on: ekklesia-release
    steps:
      - uses: actions/checkout@v4

      - name: What promoting needs
        run: |
          command -v ssh rsync curl python3 dpkg-deb git >/dev/null \
            || { apt-get update -qq && apt-get install -y -qq --no-install-recommends \
                   openssh-client rsync curl python3 dpkg git ca-certificates >/dev/null; }

      - name: Promote, and record it
        env:
          VERSION: ${{ github.event.inputs.version }}
          SHA256: ${{ github.event.inputs.sha256 }}
          APPROVAL: ${{ github.event.inputs.approval }}
          CONFIRM: ${{ github.event.inputs.confirm }}
          GITEA_TOKEN: ${{ secrets.RELEASE_API_TOKEN || github.token }}
          RELEASE_SSH_KEY: ${{ secrets.CLASSROOM_UPDATES_SSH_KEY }}
          RELEASE_SSH_KNOWN_HOSTS: ${{ vars.CLASSROOM_UPDATES_KNOWN_HOSTS }}
          RELEASE_SSH_ADDRESS: ${{ vars.CLASSROOM_UPDATES_ADDRESS }}
          RELEASE_SSH_USER: ${{ vars.CLASSROOM_UPDATES_USER }}
        run: |
          if [ "$CONFIRM" != "PROMOTE $VERSION TO STABLE" ]; then
            echo "Confirmation must read exactly: PROMOTE $VERSION TO STABLE" >&2
            exit 1
          fi
          RELEASE_CI_WORK="$RUNNER_TEMP/release" tools/release-ci.sh stable "$VERSION" "$SHA256" "$APPROVAL"