name: Nightly

on:
  push:
    branches: [main]
  schedule:
    - cron: '0 6 * * *'
  workflow_dispatch:

jobs:
  nightly:
    runs-on: pixi-build-rust
    permissions:
      contents: write
    env:
      CARGO_TARGET_DIR: /opt/cargo-target/${{ gitea.repository }}
      API: ${{ gitea.server_url }}/api/v1/repos/${{ gitea.repository }}
      TOKEN: ${{ secrets.GITEA_TOKEN }}
      TAG: nightly
      ASSET: coursebank-nightly-linux-x64.tar.gz
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          fetch-tags: true

      - name: Install the pinned toolchain
        run: pixi install

      - name: Build the release binary
        run: pixi run build

      - name: Package
        run: |
          set -euo pipefail
          tar -czf "$ASSET" \
            -C target/release coursebank \
            -C "${{ gitea.workspace }}" LICENSE.md
          sha256sum "$ASSET" > "$ASSET.sha256"

      - name: Publish the rolling nightly prerelease
        run: |
          set -euo pipefail
          auth="Authorization: token ${TOKEN}"
          # jq is fetched on demand; no toolchain change needed for it.
          jq() { pixi exec --spec jq -- jq "$@"; }

          sha="${{ gitea.sha }}"
          version=$(grep -m1 '^version' Cargo.toml | sed -E 's/.*"([^"]+)".*/\1/')
          body="Nightly build of ${version} at $(date -u +%Y-%m-%d) (commit ${sha:0:8}). Not a stable release."

          # Drop the previous nightly release and its moving tag, if present, so
          # the new one points at the current commit.
          existing=$(curl -fsSL -H "$auth" "${API}/releases/tags/${TAG}" 2>/dev/null || true)
          if [ -n "$existing" ]; then
            id=$(printf '%s' "$existing" | jq -r '.id // empty')
            [ -n "$id" ] && curl -fsSL -X DELETE -H "$auth" "${API}/releases/${id}"
          fi
          curl -fsSL -X DELETE -H "$auth" "${API}/tags/${TAG}" 2>/dev/null || true

          # Create the release at the current commit.
          rid=$(curl -fsSL -X POST -H "$auth" -H "Content-Type: application/json" \
            "${API}/releases" \
            -d "$(jq -n --arg tag "$TAG" --arg sha "$sha" --arg body "$body" \
                  '{tag_name:$tag, target_commitish:$sha, name:"Nightly", body:$body, draft:false, prerelease:true}')" \
            | jq -r '.id')

          # Attach the tarball and its checksum.
          for f in "$ASSET" "$ASSET.sha256"; do
            curl -fsSL -X POST -H "$auth" \
              -F "attachment=@${f}" \
              "${API}/releases/${rid}/assets?name=${f}"
          done