name: AOC Backfill Release

on:
  workflow_dispatch:
    inputs:
      dataset_hash:
        description: 'Dataset hash from dev rehearsal (leave empty for dev mode)'
        required: false
        default: ''
      allow_dev_key:
        description: 'Allow dev key for testing (1=yes)'
        required: false
        default: '0'

jobs:
  package-backfill:
    runs-on: ubuntu-22.04
    env:
      COSIGN_PRIVATE_KEY_B64: ${{ secrets.COSIGN_PRIVATE_KEY_B64 }}
      COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup .NET
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: 10.0.100
          include-prerelease: true

      - name: Setup cosign
        uses: sigstore/cosign-installer@v3
        with:
          cosign-release: 'v2.6.0'

      - name: Restore AOC CLI
        run: dotnet restore src/Aoc/StellaOps.Aoc.Cli/StellaOps.Aoc.Cli.csproj

      - name: Configure signing
        run: |
          if [ -z "${COSIGN_PRIVATE_KEY_B64}" ]; then
            echo "[info] No production key; using dev key"
            echo "COSIGN_ALLOW_DEV_KEY=1" >> $GITHUB_ENV
            echo "COSIGN_PASSWORD=stellaops-dev" >> $GITHUB_ENV
          fi
          if [ "${{ github.event.inputs.allow_dev_key }}" = "1" ]; then
            echo "COSIGN_ALLOW_DEV_KEY=1" >> $GITHUB_ENV
            echo "COSIGN_PASSWORD=stellaops-dev" >> $GITHUB_ENV
          fi

      - name: Package AOC backfill release
        run: |
          chmod +x ops/devops/aoc/package-backfill-release.sh
          DATASET_HASH="${{ github.event.inputs.dataset_hash }}" \
            ops/devops/aoc/package-backfill-release.sh
        env:
          DATASET_HASH: ${{ github.event.inputs.dataset_hash }}

      - name: Generate SBOM with syft
        run: |
          curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin v1.0.0
          syft dir:out/aoc/cli \
            -o spdx-json=out/aoc/aoc-backfill-runner.sbom.json \
            --name aoc-backfill-runner || true

      - name: Verify checksums
        run: |
          cd out/aoc
          sha256sum -c SHA256SUMS

      - name: Upload artifacts
        uses: actions/upload-artifact@v4
        with:
          name: aoc-backfill-release-${{ github.run_number }}
          path: |
            out/aoc/aoc-backfill-runner.tar.gz
            out/aoc/aoc-backfill-runner.manifest.json
            out/aoc/aoc-backfill-runner.sbom.json
            out/aoc/aoc-backfill-runner.provenance.json
            out/aoc/aoc-backfill-runner.dsse.json
            out/aoc/SHA256SUMS
          if-no-files-found: warn
          retention-days: 30