name: create web release
on:
  workflow_dispatch:
    inputs:
      version:
        description: 'Version number for the release (x.x.x)'
        required: true
        type: string

jobs:
  run-tests:
    uses: ./.github/workflows/web-tests.yml

  build-and-release:
    needs: run-tests
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
    steps:
    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

    - name: Set release name
      run: echo "RELEASE_NAME=capa-explorer-web-v${GITHUB_EVENT_INPUTS_VERSION}-${GITHUB_SHA::7}" >> $GITHUB_ENV
      env:
        GITHUB_EVENT_INPUTS_VERSION: ${{ github.event.inputs.version }}

    - name: Check if release already exists
      run: |
        if ls web/explorer/releases/capa-explorer-web-v${GITHUB_EVENT_INPUTS_VERSION}-* 1> /dev/null 2>&1; then
          echo "::error:: A release with version ${GITHUB_EVENT_INPUTS_VERSION} already exists"
          exit 1
        fi
      env:
        GITHUB_EVENT_INPUTS_VERSION: ${{ github.event.inputs.version }}

    - name: Set up Node.js
      uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
      with:
        node-version: 24
        cache: 'npm'
        cache-dependency-path: 'web/explorer/package-lock.json'

    - name: Install dependencies
      run: npm ci
      working-directory: web/explorer

    - name: Build offline bundle
      run: npm run build:bundle
      working-directory: web/explorer

    - name: Compress bundle
      run: zip -r ${RELEASE_NAME}.zip capa-explorer-web
      working-directory: web/explorer

    - name: Create releases directory
      run: mkdir -vp web/explorer/releases

    - name: Move release to releases folder
      run: mv web/explorer/${RELEASE_NAME}.zip web/explorer/releases

    - name: Compute release SHA256 hash
      run: |
        echo "RELEASE_SHA256=$(sha256sum web/explorer/releases/${RELEASE_NAME}.zip | awk '{print $1}')" >> $GITHUB_ENV

    - name: Update CHANGELOG.md
      run: |
        echo "## ${RELEASE_NAME}" >> web/explorer/releases/CHANGELOG.md
        echo "- Release Date: $(date -u '+%Y-%m-%d %H:%M:%S UTC')" >> web/explorer/releases/CHANGELOG.md
        echo "- SHA256: ${RELEASE_SHA256}" >> web/explorer/releases/CHANGELOG.md
        echo "" >> web/explorer/releases/CHANGELOG.md
        cat web/explorer/releases/CHANGELOG.md

    - name: Remove older releases
      # keep only the latest 3 releases
      run: ls -t capa-explorer-web-v*.zip | tail -n +4 | xargs -r rm --
      working-directory: web/explorer/releases

    - name: Stage release files
      run: |
        git config --local user.email "capa-dev@mandiant.com"
        git config --local user.name "Capa Bot"
        git add -f web/explorer/releases/${RELEASE_NAME}.zip web/explorer/releases/CHANGELOG.md
        git add -u web/explorer/releases/

    - name: Create Pull Request
      uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
      with:
        token: ${{ secrets.GITHUB_TOKEN }}
        title: "explorer web: add release v${{ github.event.inputs.version }}"
        body: |
          This PR adds a new capa Explorer Web release v${{ github.event.inputs.version }}.

          Release details:
          - Name: ${{ env.RELEASE_NAME }}
          - SHA256: ${{ env.RELEASE_SHA256 }}

          This release is generated by the [web release](https://github.com/mandiant/capa/actions/workflows/web-release.yml) workflow.

          - [x] No CHANGELOG update needed
          - [x] No new tests needed
          - [x] No documentation update needed
        commit-message: ":robot: explorer web: add release ${{ env.RELEASE_NAME }}"
        branch: release/web-v${{ github.event.inputs.version }}
        add-paths: web/explorer/releases/${{ env.RELEASE_NAME }}.zip
        base: master
        labels: webui
        delete-branch: true
        committer: Capa Bot <capa-dev@mandiant.com>
        author: Capa Bot <capa-dev@mandiant.com>