name: Standalone registry checks
on:
  push:
    branches: [main]
  workflow_dispatch: {}

jobs:
  check:
    # Register this label only on a disposable isolated runner. Never use an
    # Argand production/host runner. Prerequisites are in docs/RELEASING.md.
    runs-on: site-registry-isolated
    timeout-minutes: 30
    env:
      REGISTRY_REPOSITORY_URL: ${{ forgejo.server_url }}/${{ forgejo.repository }}.git
      REGISTRY_REVISION: ${{ forgejo.sha }}
      CARGO_BUILD_JOBS: '2'
      CARGO_TERM_COLOR: never
      RUSTC_WRAPPER: ''
    steps:
      - name: Fetch the exact public source revision without credentials
        shell: bash
        run: |
          set -euo pipefail
          [[ "$REGISTRY_REVISION" =~ ^[0-9a-f]{40}$ ]]
          mkdir checkout
          cd checkout
          git init --initial-branch=main
          git remote add origin "$REGISTRY_REPOSITORY_URL"
          git fetch --depth=1 origin "$REGISTRY_REVISION"
          git checkout --detach FETCH_HEAD
          test "$(git rev-parse HEAD)" = "$REGISTRY_REVISION"
      - name: Fetch locked build dependencies and run offline acceptance
        shell: bash
        run: |
          set -euo pipefail
          cd checkout
          export CARGO_TARGET_DIR="$PWD/target"
          export CARGO_BUILD_BUILD_DIR="$PWD/build"
          cargo fetch --locked
          bash scripts/check.sh
      - name: Verify deterministic source packaging and rebuild the archive
        shell: bash
        run: |
          set -euo pipefail
          cd checkout
          python3 scripts/source_release.py create --output ../source-release-a > ../release-a.json
          python3 scripts/source_release.py create --output ../source-release-b > ../release-b.json
          cmp ../source-release-a/source.tar.gz ../source-release-b/source.tar.gz
          cmp ../source-release-a/RELEASE.json ../source-release-b/RELEASE.json
          registry_pin="$(python3 -c 'import json; print(json.load(open("../release-a.json"))["pin"])')"
          python3 scripts/source_release.py verify --release ../source-release-a --pin "$registry_pin"
          mkdir ../unpacked
          tar -xzf ../source-release-a/source.tar.gz -C ../unpacked
          registry_prefix="$(python3 -c 'import json; print(json.load(open("../source-release-a/RELEASE.json"))["prefix"])')"
          cd "../unpacked/$registry_prefix"
          export CARGO_TARGET_DIR="$PWD/target"
          export CARGO_BUILD_BUILD_DIR="$PWD/build"
          bash scripts/check.sh