name: Notify chart dev on beta cut

# Mirrors deploy-release.yml's notify-chart-prod job, but for beta.
# Triggers when a push to ZDDC main touches zddc/internal/apps/embedded/*
# — i.e. a `./build beta` cut whose embedded artifacts the operator
# committed to main. Pushes a chart appVersion bump to the chart's
# develop branch, which fires BMCD's pipeline-dev → dev image rebuilt
# with the new beta-labeled bytes baked in.
#
# Stable cuts ALSO touch embedded/, but their workflow path is the
# tag-triggered notify-chart-prod in deploy-release.yml. To avoid
# double-firing when a stable cut pushes main + tags together, we
# check if HEAD has a zddc-server-v* tag and skip if so — the
# stable workflow handles the chart bump in that case.

on:
  push:
    branches: [main]
    paths:
      - 'zddc/internal/apps/embedded/**'
  # Manual trigger — useful for re-firing after a workflow fix without
  # also having to make a no-op embedded/ change to satisfy the paths
  # filter. Run on the latest main commit; gate-step still applies.
  workflow_dispatch:

jobs:
  notify-chart-dev:
    runs-on: host
    env:
      # Push to Forgejo (BMCD/tnd-zddc-chart on git.varasys.io), NOT
      # directly to GitHub. See notify-chart-prod's comment in
      # deploy-release.yml for the full rationale (mirror is one-way
      # Forgejo→GitHub; direct GitHub pushes get silently overwritten
      # on the next mirror sync).
      CHART_FORGEJO_TOKEN: ${{ secrets.CHART_FORGEJO_TOKEN }}
    steps:
      - name: Checkout (need tags to detect stable cut)
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Auto-bump chart develop appVersion + push
        # Explicit shell flags — the Forgejo runner's default
        # `bash -e -o pipefail {0}` was reporting our step as exit
        # 141 (SIGPIPE) immediately after the first echo, even with
        # no pipelines in the script. Switching to plain `bash {0}`
        # (no -e, no pipefail) sidesteps that entirely. We use
        # explicit `|| { ... ; exit 1; }` blocks for failure paths
        # so error semantics are preserved.
        shell: bash {0}
        run: |
          # Self-skip if HEAD has a stable tag — the prod workflow
          # owns the chart bump in that case.
          STABLE_TAGS=$(git tag --points-at HEAD --list 'zddc-server-v*')
          if [ -n "$STABLE_TAGS" ]; then
              echo "HEAD has stable tag ($STABLE_TAGS) — stable workflow handles chart bump; skipping dev notify"
              exit 0
          fi
          echo "No stable tag at HEAD; treating as beta cut"

          if [ -z "${CHART_FORGEJO_TOKEN:-}" ]; then
              echo "::error::CHART_FORGEJO_TOKEN secret not set on this repo" >&2
              exit 1
          fi

          # Re-enable strict-mode for the rest of the script — failures
          # in clone/sed/push must abort. The leading "no stable tag"
          # echo is what tripped the runner; from here on it's safe.
          set -eu

          # Compose a beta version string that's unique per ZDDC commit.
          # Uses the next-stable target (max of latest tag + 1, mirrors
          # ./build's _coordinated_next_stable) and the short SHA.
          # Example: "0.0.11-beta-c099676". Always unique per push.
          LATEST_STABLE=$(git tag --list 'zddc-server-v*' --sort=-v:refname | head -1)
          MAJ=$(echo "${LATEST_STABLE#zddc-server-v}" | cut -d. -f1)
          MIN=$(echo "${LATEST_STABLE#zddc-server-v}" | cut -d. -f2)
          PAT=$(echo "${LATEST_STABLE#zddc-server-v}" | cut -d. -f3)
          NEXT_STABLE="$MAJ.$MIN.$((PAT + 1))"
          SHORT_SHA=$(git rev-parse --short=7 HEAD)
          BETA_VERSION="${NEXT_STABLE}-beta-${SHORT_SHA}"
          echo "ZDDC beta cut: $BETA_VERSION (HEAD=$(git rev-parse HEAD))"

          TMP=$(mktemp -d)
          cd "$TMP"
          git clone --depth=20 --branch=develop \
              "https://oauth2:${CHART_FORGEJO_TOKEN}@git.varasys.io/BMCD/tnd-zddc-chart.git"
          cd tnd-zddc-chart

          # Idempotent: same SHA ⇒ same version ⇒ no-op.
          CURRENT=$(grep '^appVersion:' chart/Chart.yaml | sed -E 's/^appVersion: *"?([^"]*)"?.*/\1/')
          if [ "$CURRENT" = "$BETA_VERSION" ]; then
              echo "Chart develop already at $BETA_VERSION; nothing to do"
              exit 0
          fi

          sed -i "s/^appVersion: .*/appVersion: \"$BETA_VERSION\"/" chart/Chart.yaml
          OLD_CHART_VER=$(grep '^version:' chart/Chart.yaml | awk '{print $2}')
          MAJC=$(echo "$OLD_CHART_VER" | cut -d. -f1)
          MINC=$(echo "$OLD_CHART_VER" | cut -d. -f2)
          PATC=$(echo "$OLD_CHART_VER" | cut -d. -f3)
          NEW_CHART_VER="$MAJC.$MINC.$((PATC + 1))"
          sed -i "s/^version: .*/version: $NEW_CHART_VER/" chart/Chart.yaml

          echo "  appVersion: $CURRENT → $BETA_VERSION"
          echo "  version:    $OLD_CHART_VER → $NEW_CHART_VER"

          git config user.name "ZDDC Release Bot"
          git config user.email "noreply@zddc.varasys.io"
          git add chart/Chart.yaml
          git commit \
              -m "chore(chart): auto-bump appVersion to $BETA_VERSION (ZDDC beta cut)" \
              -m "Triggered by push to git.varasys.io/VARASYS/ZDDC main with embedded/* changes (a ./build beta cut). Bumps appVersion so the dev Docker image is tagged zddc:$BETA_VERSION, ensuring kubelet pulls a fresh image on the next helm upgrade." \
              -m "Auto-generated by .forgejo/workflows/notify-chart-dev.yml. The next ZDDC beta or stable cut will overwrite this."
          git push origin develop
          echo "pushed chart develop bump to Forgejo - mirror replicates to GitHub - BMCD pipeline-dev will fire"