name: Post-merge profiles

# Push-triggered counterpart to check_profiles.yml (which only gates PRs). When a
# profile change lands on main or a release branch, rebuild the affected vendors'
# binary preset caches (<vendor>.opc) and publish each as a versioned ZIP asset on
# a per-Orca-version release of the profiles repo. From there OrcaCloud's OTA
# Manager lists the asset, a maintainer attaches a changelog and hits Publish, and
# only then does it become a live OTA update - this workflow does none of that
# last part (no changelog, no R2, no webhook).
#
# Asset contract expected by OrcaCloud's release scanner:
#   ^(\d+\.\d+\.\d+)_([^_]+)_(\d+(?:\.\d+){3})_(\d{12})\.zip$
#     <orca_ver>_<vendor>_<profile_version>_<UTC yyyymmddHHMM>.zip   (zip root: <vendor>.opc)
#
# Setup (App + secrets): docs/ota/post-merge-profiles-setup.md

on:
  push:
    branches:
    - main
    - release/*
    paths:
    - 'resources/profiles/**'
    - '.github/workflows/post_merge_profiles.yml'

  workflow_dispatch:

permissions:
  contents: read

# One run per branch; let a run finish rather than cancel it, since it publishes.
concurrency:
  group: post-merge-profiles-${{ github.ref }}
  cancel-in-progress: false

env:
  # generate_system_cache is published to this repo's own nightly-builds release
  # by build_orca.yml's Linux leg. The job guard pins github.repository to
  # OrcaSlicer/OrcaSlicer, so this resolves there.
  TOOL_REPO: ${{ github.repository }}
  TOOL_ASSET: generate_system_cache_Linux_Ubuntu2404_nightly
  # Where per-vendor ZIP assets are published; OrcaCloud's OTA reads this repo.
  PROFILES_OWNER: OrcaSlicer
  PROFILES_REPO: orcaslicer-profiles

jobs:
  publish_profile_caches:
    name: Publish profile caches
    if: ${{ github.repository == 'OrcaSlicer/OrcaSlicer' }}
    # FOLDER_MERGERS is an environment-scoped variable, shared with the PR
    # merge bot. Keep this environment free of protection rules so this
    # push-triggered job does not wait for a reviewer.
    environment: merge-delegation
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7
        with:
          # Enough history to reach github.event.before for the changed-vendor
          # diff on a normal push; deeper pushes fall back to HEAD^..HEAD in the
          # step below. fetch-depth: 0 would clone all of OrcaSlicer's history.
          fetch-depth: 50

      - name: Resolve changed vendors
        id: vendors
        shell: bash
        env:
          FOLDER_MERGERS: ${{ vars.FOLDER_MERGERS }}
        run: |
          set -euo pipefail
          base='${{ github.event.before }}'
          head='${{ github.sha }}'
          # Zero SHA (branch created / force push) or manual dispatch: fall back
          # to this commit's own diff.
          if [ -z "$base" ] || [ "$base" = "0000000000000000000000000000000000000000" ] || ! git cat-file -e "$base^{commit}" 2>/dev/null; then
            base="$head^"
          fi
          echo "Diffing $base..$head"

          mapfile -t candidates < <(
            git diff --name-only "$base" "$head" -- resources/profiles \
              | sed -nE 's#^resources/profiles/([^/]+)/.*#\1#p; s#^resources/profiles/([^/]+)\.json$#\1#p' \
              | sort -u
          )

          vendors=()
          for v in "${candidates[@]:-}"; do
            [ -n "$v" ] || continue
            json="resources/profiles/$v.json"
            # A vendor has a manifest plus either a preset directory or a version
            # field; this drops non-vendor files such as blacklist.json.
            if [ -f "$json" ] && { [ -d "resources/profiles/$v" ] || jq -e '.version' "$json" >/dev/null 2>&1; }; then
              vendors+=("$v")
            fi
          done

          if [ "${#vendors[@]}" -eq 0 ]; then
            echo "No changed vendor profiles in this push; nothing to publish."
            echo "vendors=" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          # A vendor is eligible only when both the profile directory and its
          # sibling bundle JSON are covered by at least one FOLDER_MERGERS
          # grant. The account part is intentionally ignored here: this is a
          # post-merge safety check, not an authorization check for a command.
          grants=()
          while IFS= read -r raw_line; do
            line="${raw_line#"${raw_line%%[![:space:]]*}"}"
            line="${line%"${line##*[![:space:]]}"}"
            [ -n "$line" ] || continue
            [[ "$line" == \#* ]] && continue
            [[ "$line" == *:* ]] || continue

            grant="${line#*:}"
            grant="${grant#"${grant%%[![:space:]]*}"}"
            grant="${grant%"${grant##*[![:space:]]}"}"
            while [[ "$grant" == */ ]]; do grant="${grant%/}"; done
            grants+=("$grant")
          done <<< "${FOLDER_MERGERS:-}"

          is_granted() {
            local path="$1"
            local grant
            for grant in "${grants[@]:-}"; do
              if [[ "$path" == "$grant" || "$path" == "$grant/"* ]]; then
                return 0
              fi
            done
            return 1
          }

          unauthorized=()
          for v in "${vendors[@]}"; do
            if ! is_granted "resources/profiles/$v" || ! is_granted "resources/profiles/$v.json"; then
              unauthorized+=("$v")
            fi
          done

          if [ "${#unauthorized[@]}" -ne 0 ]; then
            echo "Changed vendor profiles are not covered by FOLDER_MERGERS: ${unauthorized[*]}"
            echo "No profile caches will be published for this push."
            echo "vendors=" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          printf 'Changed vendors: %s\n' "${vendors[*]}"
          echo "vendors=${vendors[*]}" >> "$GITHUB_OUTPUT"

      - name: Resolve Orca version
        id: orca
        if: steps.vendors.outputs.vendors != ''
        shell: bash
        run: |
          set -euo pipefail
          raw="$(sed -nE 's/^set\(SoftFever_VERSION "([^"]+)".*/\1/p' version.inc | head -1)"
          [ -n "$raw" ] || { echo "::error::could not read SoftFever_VERSION from version.inc"; exit 1; }
          orca_ver="${raw%%-*}"
          if ! [[ "$orca_ver" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "::error::Orca version '$orca_ver' (from '$raw') is not X.Y.Z"; exit 1
          fi
          # release_tag is what the desktop client sends as orca_version and what
          # OrcaCloud keys R2 on; orca_ver (X.Y.Z) is the asset-name prefix.
          echo "release_tag=$raw" >> "$GITHUB_OUTPUT"
          echo "orca_ver=$orca_ver" >> "$GITHUB_OUTPUT"
          echo "Orca version: release_tag=$raw asset_prefix=$orca_ver"

      - name: Validate profile versions
        id: pver
        if: steps.vendors.outputs.vendors != ''
        shell: bash
        run: |
          set -euo pipefail
          : > "$RUNNER_TEMP/pver.tsv"
          for v in ${{ steps.vendors.outputs.vendors }}; do
            pv="$(jq -r '.version // empty' "resources/profiles/$v.json")"
            if ! [[ "$pv" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
              echo "::error::vendor $v version '${pv:-<none>}' must be 4 numeric parts (A.B.C.D) for the OTA asset name; fix resources/profiles/$v.json"
              exit 1
            fi
            printf '%s\t%s\n' "$v" "$pv" >> "$RUNNER_TEMP/pver.tsv"
            echo "$v -> $pv"
          done

      - name: Download generate_system_cache
        if: steps.vendors.outputs.vendors != ''
        shell: bash
        env:
          # gh (with the default token) rather than an unauthenticated curl: keeps
          # working if TOOL_REPO is ever private and avoids anonymous rate limits.
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          gh release download nightly-builds --repo "$TOOL_REPO" \
            --pattern "$TOOL_ASSET" --output generate_system_cache --clobber
          chmod +x generate_system_cache

      - name: Build caches and package assets
        id: pkg
        if: steps.vendors.outputs.vendors != ''
        shell: bash
        run: |
          set -euo pipefail
          # One timestamp for the whole run so a multi-vendor merge groups together.
          ts="$(date -u +%Y%m%d%H%M)"
          orca_ver='${{ steps.orca.outputs.orca_ver }}'
          out="$RUNNER_TEMP/assets"
          mkdir -p "$out"

          for v in ${{ steps.vendors.outputs.vendors }}; do
            ./generate_system_cache -p "$GITHUB_WORKSPACE/resources/profiles" -v "$v" -l 2
            opc="resources/profiles/$v.opc"
            [ -f "$opc" ] || { echo "::error::$opc was not generated"; exit 1; }
            pv="$(awk -F'\t' -v v="$v" '$1==v{print $2}' "$RUNNER_TEMP/pver.tsv")"
            name="${orca_ver}_${v}_${pv}_${ts}.zip"
            ( cd resources/profiles && zip -q -j "$out/$name" "$v.opc" )
            echo "packaged $name"
          done
          echo "dir=$out" >> "$GITHUB_OUTPUT"

      - name: Mint profiles-repo token
        id: token
        if: steps.vendors.outputs.vendors != ''
        uses: actions/create-github-app-token@v1
        with:
          app-id: ${{ secrets.PROFILES_APP_ID }}
          private-key: ${{ secrets.PROFILES_APP_PRIVATE_KEY }}
          owner: ${{ env.PROFILES_OWNER }}
          repositories: ${{ env.PROFILES_REPO }}

      - name: Publish assets to profiles release
        if: steps.vendors.outputs.vendors != ''
        shell: bash
        env:
          GH_TOKEN: ${{ steps.token.outputs.token }}
          RELEASE_TAG: ${{ steps.orca.outputs.release_tag }}
          ASSET_DIR: ${{ steps.pkg.outputs.dir }}
        run: |
          set -euo pipefail
          repo="$PROFILES_OWNER/$PROFILES_REPO"
          if ! gh release view "$RELEASE_TAG" --repo "$repo" >/dev/null 2>&1; then
            echo "Creating release $RELEASE_TAG on $repo"
            gh release create "$RELEASE_TAG" --repo "$repo" \
              --title "$RELEASE_TAG" --notes "Profile cache assets for Orca $RELEASE_TAG." \
              --latest=false
          fi
          # Asset names are timestamp-unique; a clash means a bug, so don't --clobber.
          gh release upload "$RELEASE_TAG" --repo "$repo" "$ASSET_DIR"/*.zip

          {
            echo "### Published to \`$repo\` release \`$RELEASE_TAG\`"
            for f in "$ASSET_DIR"/*.zip; do echo "- \`$(basename "$f")\`"; done
          } >> "$GITHUB_STEP_SUMMARY"