$ErrorActionPreference = 'Stop'
Set-StrictMode -Version Latest

if (-not $env:CI_COMMIT_TAG -or $env:CI_COMMIT_TAG -notmatch '^v(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)$') {
    throw 'Release must run from a vMAJOR.MINOR.PATCH tag.'
}
if (-not $env:GITEA_TOKEN) {
    throw 'GITEA_TOKEN is required.'
}
$version = $Matches[1]
$root = Split-Path -Parent $PSScriptRoot
$backend = Join-Path $root 'backend'
$projectVersion = [regex]::Match((Get-Content (Join-Path $backend 'Directory.Build.props') -Raw), '<Version>([^<]+)</Version>').Groups[1].Value
if ($version -ne $projectVersion) {
    throw "Tag version $version does not match project version $projectVersion."
}

Add-Type -AssemblyName System.Formats.Tar
$giteaBase = if ($env:GITEA_BASE) { $env:GITEA_BASE.TrimEnd('/') } else { 'http://localhost:3100' }
$netrc = Join-Path $env:TEMP ("monitor-gitea-$([guid]::NewGuid().ToString('N')).netrc")
$giteaHost = ([Uri]$giteaBase).Host
Set-Content -LiteralPath $netrc -Value "machine $giteaHost login justme password $($env:GITEA_TOKEN)" -Encoding ascii -NoNewline

function New-TarGzArchive([string]$SourceDirectory, [string]$ArchivePath, [string[]]$Executables) {
    $tarFile = [IO.File]::Create($ArchivePath)
    $gzip = [IO.Compression.GZipStream]::new($tarFile, [IO.Compression.CompressionLevel]::Optimal, $true)
    $writer = [System.Formats.Tar.TarWriter]::new($gzip, [System.Formats.Tar.TarEntryFormat]::Pax, $true)
    $executableMode = [System.IO.UnixFileMode]::UserRead -bor [System.IO.UnixFileMode]::UserWrite -bor [System.IO.UnixFileMode]::UserExecute -bor [System.IO.UnixFileMode]::GroupRead -bor [System.IO.UnixFileMode]::GroupExecute -bor [System.IO.UnixFileMode]::OtherRead -bor [System.IO.UnixFileMode]::OtherExecute
    $regularMode = [System.IO.UnixFileMode]::UserRead -bor [System.IO.UnixFileMode]::UserWrite -bor [System.IO.UnixFileMode]::GroupRead -bor [System.IO.UnixFileMode]::OtherRead
    try {
        foreach ($file in Get-ChildItem -LiteralPath $SourceDirectory -File -Recurse) {
            $relativePath = [IO.Path]::GetRelativePath($SourceDirectory, $file.FullName).Replace('\', '/')
            $entry = [System.Formats.Tar.PaxTarEntry]::new([System.Formats.Tar.TarEntryType]::RegularFile, $relativePath)
            $entry.Mode = if ($Executables -contains $relativePath) { $executableMode } else { $regularMode }
            $entry.DataStream = [IO.File]::OpenRead($file.FullName)
            try { $writer.WriteEntry($entry) } finally { $entry.DataStream.Dispose() }
        }
    }
    finally {
        $writer.Dispose()
        $gzip.Dispose()
        $tarFile.Dispose()
    }
}

function Upload-Package([string]$File) {
    $name = Split-Path -Leaf $File
    $url = "$giteaBase/api/packages/justme/generic/monitor-node/$version/$name"
    $status = & curl.exe --silent --show-error --retry 3 --netrc-file $netrc --upload-file $File --output NUL --write-out '%{http_code}' $url
    if ($LASTEXITCODE -ne 0) {
        throw "Gitea package upload failed for $name."
    }
    if ($status -match '^2') {
        Write-Output "uploaded Gitea package $name"
    }
    elseif ($status -eq '409') {
        Write-Output "Gitea package $name already exists; reusing the existing release file"
    }
    else {
        throw "Gitea package upload failed for $name (HTTP $status)."
    }
}

try {
    $targets = @(
        @{ Rid = 'linux-x64'; Os = 'linux'; Arch = 'amd64'; Windows = $false },
        @{ Rid = 'linux-arm64'; Os = 'linux'; Arch = 'arm64'; Windows = $false },
        @{ Rid = 'linux-arm'; Os = 'linux'; Arch = 'arm'; Windows = $false },
        @{ Rid = 'linux-musl-x64'; Os = 'linux'; Arch = 'musl-amd64'; Windows = $false },
        @{ Rid = 'linux-musl-arm64'; Os = 'linux'; Arch = 'musl-arm64'; Windows = $false },
        @{ Rid = 'linux-musl-arm'; Os = 'linux'; Arch = 'musl-arm'; Windows = $false },
        @{ Rid = 'osx-x64'; Os = 'macos'; Arch = 'x64'; Windows = $false },
        @{ Rid = 'osx-arm64'; Os = 'macos'; Arch = 'arm64'; Windows = $false },
        @{ Rid = 'win-x64'; Os = 'windows'; Arch = 'amd64'; Windows = $true },
        @{ Rid = 'win-arm64'; Os = 'windows'; Arch = 'arm64'; Windows = $true }
    )
    $packageRoot = Join-Path $root '.release\packages'
    $null = New-Item -ItemType Directory -Force -Path $packageRoot
    foreach ($target in $targets) {
        $agentDirectory = Join-Path $root ".release\publish\$($target.Rid)\agent"
        $probeDirectory = Join-Path $root ".release\publish\$($target.Rid)\probe"
        $enrollDirectory = Join-Path $root ".release\publish\$($target.Rid)\fleet-enroll"
        foreach ($path in @($agentDirectory, $probeDirectory, $enrollDirectory)) {
            if (-not (Test-Path -LiteralPath $path -PathType Container)) {
                throw "Build output is missing: $path"
            }
        }

        foreach ($role in @('agent', 'probe')) {
            $stage = Join-Path $root ".release\stage\$($target.Rid)\$role"
            $null = New-Item -ItemType Directory -Force -Path $stage
            $extension = if ($target.Windows) { '.exe' } else { '' }
            Copy-Item -LiteralPath (Join-Path (Join-Path $root ".release\publish\$($target.Rid)\$role") "monitor-$role$extension") -Destination $stage
            Copy-Item -LiteralPath (Join-Path $root 'LICENSE') -Destination $stage
            Copy-Item -LiteralPath (Join-Path $root "backend\$role\README.md") -Destination $stage

            $executables = @("monitor-$role$extension")
            if ($role -eq 'agent') {
                $enrollName = if ($target.Windows) { 'fleet-enroll.exe' } else { 'fleet-enroll' }
                Copy-Item -LiteralPath (Join-Path $enrollDirectory $enrollName) -Destination $stage
                $executables += $enrollName
            }
            if ($target.Os -eq 'linux') {
                Copy-Item -LiteralPath (Join-Path $root 'packaging/install.sh') -Destination $stage
                $executables += 'install.sh'
                $systemd = Join-Path $stage 'systemd'
                $null = New-Item -ItemType Directory -Force -Path $systemd
                Copy-Item -LiteralPath (Join-Path $root "packaging/systemd/monitor-$role.service") -Destination $systemd
                if ($role -eq 'probe') {
                    $openwrt = Join-Path $stage 'openwrt'
                    $null = New-Item -ItemType Directory -Force -Path $openwrt
                    Copy-Item -LiteralPath (Join-Path $root 'packaging/openwrt/monitor-probe.init') -Destination $openwrt
                    Copy-Item -LiteralPath (Join-Path $root 'packaging/openwrt/monitor.keep') -Destination $openwrt
                }
            }
            elseif ($target.Os -eq 'macos') {
                @'
This macOS NativeAOT binary is not signed with a Developer ID certificate and
has not been notarized by Apple. Apple Silicon builds receive an ad-hoc code
signature; Intel builds are unsigned. Gatekeeper may block browser-downloaded
files. A Developer ID signature and notarization are required for a seamless
consumer install.
'@ | Set-Content -LiteralPath (Join-Path $stage 'MACOS-SECURITY.txt') -Encoding utf8
            }

            $archiveName = if ($target.Windows) { "monitor-$role-v$version-windows-$($target.Arch).zip" } else { "monitor-$role-v$version-$($target.Os)-$($target.Arch).tar.gz" }
            $archive = Join-Path $packageRoot $archiveName
            if ($target.Windows) {
                Compress-Archive -Path (Join-Path $stage '*') -DestinationPath $archive -CompressionLevel Optimal -Force
            }
            else {
                New-TarGzArchive $stage $archive $executables
            }
            $hash = (Get-FileHash -LiteralPath $archive -Algorithm SHA256).Hash.ToLowerInvariant()
            $checksum = "$hash  $archiveName`n"
            $checksumPath = "$archive.sha256"
            [IO.File]::WriteAllText($checksumPath, $checksum, [Text.UTF8Encoding]::new($false))
            Upload-Package $archive
            Upload-Package $checksumPath
        }
    }
}
finally {
    Remove-Item -LiteralPath $netrc -Force -ErrorAction SilentlyContinue
}