# This workflow is responsible to build and publish a release build
# It triggers once a new GitHub Release is published
name: Publish CI

on:
  release:
    types:
      - released
  workflow_dispatch:

permissions: { }

jobs:
  read-version:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.parse.outputs.version }}
    steps:
      - name: Assert ref type
        run: |-
          if [[ "$GITHUB_REF_TYPE" != "tag" ]]; then
            echo "::error::Publishing is only supported for tags!"
            exit 1
          fi
      - name: Checkout Repository
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # tag=v5.0.0

      - name: Parse Version from POM
        id: parse
        run: |-
          VERSION=`yq -p=xml '.project.version' pom.xml`
          echo "version=${VERSION}" >> $GITHUB_OUTPUT

  call-build:
    needs:
      - read-version
    uses: ./.github/workflows/_meta-build.yaml
    with:
      app-version: ${{ needs.read-version.outputs.version }}
      publish-container: true
      ref-name: ${{ github.ref_name }}
    permissions:
      security-events: write # Required to upload trivy's SARIF output
    secrets:
      registry-0-usr: ${{ secrets.HUB_USERNAME }}
      registry-0-psw: ${{ secrets.HUB_ACCESSS_TOKEN }}

  update-github-release:
    runs-on: ubuntu-latest
    needs:
      - read-version
      - call-build
    steps:
      - name: Checkout Repository
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # tag=v5.0.0

      - name: Download Artifacts
        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # tag=v5.0.0
        with:
          name: assembled-wars
          path: target

      - name: Create Checksums and SBOM
        run: |-
          pushd target
          echo "# SHA1" >> checksums.txt
          sha1sum dependency-track-apiserver.jar dependency-track-bundled.jar >> checksums.txt
          echo "# SHA256" >> checksums.txt
          sha256sum dependency-track-apiserver.jar dependency-track-bundled.jar >> checksums.txt
          echo "# SHA512" >> checksums.txt
          sha512sum dependency-track-apiserver.jar dependency-track-bundled.jar >> checksums.txt
          popd

      - name: Update Release
        env:
          GITHUB_TOKEN: ${{ secrets.BOT_RELEASE_TOKEN }}
        run: |-
          cat << EOF >> .github/default-release-notes.md
          \`\`\`text
          $(cat target/checksums.txt)
          \`\`\`
          EOF
          
          gh release view ${{ needs.read-version.outputs.version }} \
            --json body --jq .body >> .github/default-release-notes.md

          gh release edit ${{ needs.read-version.outputs.version }} \
            --notes-file ".github/default-release-notes.md"

          gh release upload ${{ needs.read-version.outputs.version }} \
            --clobber \
            target/dependency-track-apiserver.jar \
            target/dependency-track-bundled.jar \
            target/checksums.txt \
            target/bom.json
