name: Release Verification

on:
  workflow_run:
    workflows: ["Release pipeline"]
    types: [completed]
  workflow_dispatch:
    inputs:
      tag:
        description: 'Release tag to verify'
        required: true

permissions:
  contents: read

jobs:
  verify:
    if: >-
      github.event_name == 'workflow_dispatch' ||
      (github.event.workflow_run.conclusion == 'success' &&
      startsWith(github.event.workflow_run.head_branch, 'v'))
    runs-on: ubuntu-latest
    steps:
      - name: Checkout tests
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          sparse-checkout: |
            tests/release-verification
            tests/contracts/monitor-snapshot-v1.txt
          sparse-checkout-cone-mode: false

      - name: Determine Tag
        id: tag
        env:
          MANUAL_TAG: ${{ inputs.tag }}
          RELEASE_TAG: ${{ github.event.workflow_run.head_branch }}
        run: |
          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
            tag="$MANUAL_TAG"
          else
            tag="$RELEASE_TAG"
          fi
          [[ "$tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?$ ]] \
            || { echo "Invalid release tag: $tag" >&2; exit 1; }
          echo "tag=$tag" >> "$GITHUB_OUTPUT"

      - name: Verify Assets List
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          bash tests/release-verification/verify-assets.sh "${{ steps.tag.outputs.tag }}"

      - name: Isolate Workspace
        run: |
          # Move tests to a safe location and clean the workspace
          # This ensures the installation does not accidentally use source files
          cp -r tests /tmp/isolated_tests
          rm -rf * .git

      - name: Run Positive Installation
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          mkdir -p workspace
          cd workspace
          # Bring contract back for verification script
          mkdir -p tests/contracts
          cp /tmp/isolated_tests/contracts/monitor-snapshot-v1.txt tests/contracts/
          bash /tmp/isolated_tests/release-verification/run-positive-installation.sh "${{ steps.tag.outputs.tag }}"

      - name: Run Negative Tests
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          mkdir -p workspace-neg
          cd workspace-neg
          bash /tmp/isolated_tests/release-verification/run-negative-tests.sh "${{ steps.tag.outputs.tag }}"