name: Gitea Runner E2E — publish + integrity check

on:
  workflow_dispatch:
    inputs:
      version:
        description: Test version to publish
        required: true
        default: 0.0.1-e2e.1
  push:
    branches: [runner/gitea-e2e]

concurrency:
  group: runner-e2e-publish-${{ github.ref }}
  cancel-in-progress: false

jobs:
  publish:
    runs-on: [ubuntu-latest, bytelyst, hostinger]
    timeout-minutes: 15
    container:
      image: node:20-bookworm
      options: -v /home/gitea-runner/.gitea_npm_token:/run/secrets/gitea_npm_token:ro

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install pnpm
        run: |
          npm install -g pnpm@9.12.0
          pnpm --version

      - name: Set test version
        working-directory: packages/_runner-e2e-test
        run: |
          VERSION="${{ github.event.inputs.version }}"
          if [ -z "$VERSION" ]; then VERSION="0.0.1-e2e.1"; fi
          echo "TEST_VERSION=$VERSION" >> "$GITHUB_ENV"
          npm version "$VERSION" --no-git-tag-version --allow-same-version
          node -p "require('./package.json').version"

      - name: Configure registry .npmrc
        working-directory: packages/_runner-e2e-test
        run: |
          TOKEN=$(tr -d '\n' < /run/secrets/gitea_npm_token)
          cat > .npmrc <<NPMRC
          @bytelyst:registry=https://gitea.bytelyst.com/api/packages/bytelyst/npm/
          //gitea.bytelyst.com/api/packages/bytelyst/npm/:_authToken=$TOKEN
          NPMRC
          echo ".npmrc (token masked):"
          sed 's|_authToken=.*|_authToken=***|' .npmrc

      - name: Publish to Hostinger Gitea
        working-directory: packages/_runner-e2e-test
        run: pnpm publish --no-git-checks --registry https://gitea.bytelyst.com/api/packages/bytelyst/npm/

      - name: Verify package returned by Gitea
        run: |
          TOKEN=$(tr -d '\n' < /run/secrets/gitea_npm_token)
          RESP=$(curl -fsS -H "Authorization: token $TOKEN" "https://gitea.bytelyst.com/api/packages/bytelyst/npm/@bytelyst%2F_runner-e2e-test")
          printf '%s' "$RESP" | python3 -c 'import json,sys; data=json.load(sys.stdin); print("package:", data.get("name")); print("versions:", ",".join(sorted(data.get("versions", {}).keys())))'
          echo "$RESP" | grep -q "\"$TEST_VERSION\"" || { echo "FAIL: version missing from Gitea"; exit 1; }
          echo "PASS: version in Gitea"

      - name: Verify pnpm install + require works from a clean dir
        run: |
          TOKEN=$(tr -d '\n' < /run/secrets/gitea_npm_token)
          mkdir -p /tmp/runner-e2e-consumer && cd /tmp/runner-e2e-consumer
          cat > .npmrc <<NPMRC
          @bytelyst:registry=https://gitea.bytelyst.com/api/packages/bytelyst/npm/
          //gitea.bytelyst.com/api/packages/bytelyst/npm/:_authToken=$TOKEN
          NPMRC
          cat > package.json <<JSON
          { "name": "consumer", "version": "1.0.0", "dependencies": { "@bytelyst/_runner-e2e-test": "$TEST_VERSION" } }
          JSON
          pnpm install --no-frozen-lockfile
          node -e "const m=require('@bytelyst/_runner-e2e-test'); console.log(m); process.exit(m.ok?0:1);"
          echo "PASS: install + require works"

      - name: Verify local pack matches Gitea stored tarball shasum
        working-directory: packages/_runner-e2e-test
        run: |
          TOKEN=$(tr -d '\n' < /run/secrets/gitea_npm_token)
          pnpm pack --pack-destination /tmp
          TARBALL=$(ls /tmp/bytelyst-_runner-e2e-test-*.tgz)
          LOCAL_SHA=$(sha1sum "$TARBALL" | awk '{print $1}')
          RESP=$(curl -fsS -H "Authorization: token $TOKEN" "https://gitea.bytelyst.com/api/packages/bytelyst/npm/@bytelyst%2F_runner-e2e-test/$TEST_VERSION")
          GITEA_SHA=$(printf '%s' "$RESP" | python3 -c 'import json,sys; print(json.load(sys.stdin)["dist"]["shasum"])')
          echo "LOCAL_SHA=$LOCAL_SHA"
          echo "GITEA_SHA=$GITEA_SHA"
          [ "$LOCAL_SHA" = "$GITEA_SHA" ] || { echo "FAIL: pnpm pack tarball does not match Gitea stored tarball"; exit 1; }
          echo "PASS: byte-identical tarball stored in Hostinger Gitea"