name: Sync otelcol-contrib v0.* (matrix)

on:
  workflow_dispatch:
    inputs:
      tag:
        description: "Release tag to sync (e.g., v0.133.0). Defaults to v0.133.0"
        required: false
        type: string
  schedule:
    - cron: "0 2 * * *" # <-- 这是 UTC 02:00。若需 JST 02:00，请改为 "0 17 * * *"

# 让内置 GITHUB_TOKEN 具备读 release 资产的权限
permissions:
  contents: read

concurrency:
  group: sync-otelcol-contrib-v0
  cancel-in-progress: false

jobs:
  prep:
    name: Resolve tag & remote check
    runs-on: ubuntu-latest
    env:
      GH_REPO: open-telemetry/opentelemetry-collector-releases
      GH_TOKEN: ${{ github.token }}          # 用内置 token，无需自建 PAT
      RSYNC_SSH_KEY: ${{ secrets.RSYNC_SSH_KEY }}
      RSYNC_SSH_USER: ${{ secrets.RSYNC_SSH_USER }}
      VPS_HOST: ${{ secrets.VPS_HOST }}
      REMOTE_ROOT: /data/update-server/otel/OpenTelemetry/
      DEFAULT_TAG: v0.133.0
    outputs:
      tag: ${{ steps.resolve.outputs.tag }}
      version: ${{ steps.resolve.outputs.version }}
      exists: ${{ steps.remotecheck.outputs.exists }}
    steps:
      - uses: actions/checkout@v4

      - name: Ensure GitHub CLI & deps
        run: |
          set -euo pipefail
          sudo apt-get update -y
          sudo apt-get install -y gh jq rsync
          gh --version
          jq --version
          rsync --version | head -n1

      - name: Resolve tag (use input or default)
        id: resolve
        run: |
          set -euo pipefail
          TAG_INPUT='${{ github.event.inputs.tag }}'
          if [ -n "$TAG_INPUT" ]; then
            TAG="$TAG_INPUT"
          else
            TAG="$DEFAULT_TAG"
          fi

          # 基本校验：必须形如 v0.X.Y
          if ! echo "$TAG" | grep -Eq '^v0\.[0-9]+\.[0-9]+$'; then
            echo "Invalid tag format: $TAG" >&2
            exit 1
          fi

          VERSION="${TAG#v}"  # 去掉前缀 v，例如 v0.133.0 -> 0.133.0
          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "Use tag: $TAG (version=$VERSION)"

      - name: Init SSH
        run: |
          set -euo pipefail
          mkdir -p ~/.ssh
          echo "$RSYNC_SSH_KEY" > ~/.ssh/id_rsa
          chmod 600 ~/.ssh/id_rsa
          ssh-keyscan -H "$VPS_HOST" >> ~/.ssh/known_hosts

      - name: Check remote existing tag
        id: remotecheck
        env:
          TAG: ${{ steps.resolve.outputs.tag }}
        run: |
          set -euo pipefail
          REMOTE_DIR="${REMOTE_ROOT}/${TAG}"
          if ssh -i ~/.ssh/id_rsa "${RSYNC_SSH_USER}@${VPS_HOST}" "test -d '${REMOTE_DIR}'"; then
            echo "exists=true" >> "$GITHUB_OUTPUT"
            echo "Remote already has ${REMOTE_DIR}, skip whole sync."
          else
            echo "exists=false" >> "$GITHUB_OUTPUT"
            echo "Remote does not have ${REMOTE_DIR}, will sync."
          fi

  sync-one:
    name: Sync ${{ matrix.asset_prefix }}_${{ matrix.asset_suffix }} for ${{ needs.prep.outputs.tag }}
    needs: prep
    if: needs.prep.outputs.exists == 'false'   # 远端已存在则整个矩阵跳过
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - asset_prefix: "otelcol-contrib"
            asset_suffix: "linux_amd64.tar.gz"
            release_tag_prefix: ""
          - asset_prefix: "otelcol-contrib"
            asset_suffix: "linux_arm64.tar.gz"
            release_tag_prefix: ""
          - asset_prefix: "opampsupervisor"
            asset_suffix: "linux_amd64"
            release_tag_prefix: "cmd/opampsupervisor/"
          - asset_prefix: "opampsupervisor"
            asset_suffix: "linux_arm64"
            release_tag_prefix: "cmd/opampsupervisor/"
    env:
      GH_REPO: open-telemetry/opentelemetry-collector-releases
      GH_TOKEN: ${{ github.token }}          # 继续使用内置 token
      RSYNC_SSH_KEY: ${{ secrets.RSYNC_SSH_KEY }}
      RSYNC_SSH_USER: ${{ secrets.RSYNC_SSH_USER }}
      VPS_HOST: ${{ secrets.VPS_HOST }}
      REMOTE_ROOT: /data/update-server/otel/OpenTelemetry
      TAG: ${{ needs.prep.outputs.tag }}
      VERSION: ${{ needs.prep.outputs.version }}
    steps:
      - uses: actions/checkout@v4

      - name: Ensure GitHub CLI & deps
        run: |
          set -euo pipefail
          sudo apt-get update -y
          sudo apt-get install -y gh jq rsync
          gh --version

      - name: Check asset exists via GitHub CLI
        id: has_asset
        run: |
          set -euo pipefail
          ASSET="${{ matrix.asset_prefix }}_${VERSION}_${{ matrix.asset_suffix }}"
          RELEASE_TAG="${{ matrix.release_tag_prefix }}${TAG}"
          echo "Checking asset $ASSET for release tag ${RELEASE_TAG}"
          ASSET_LIST=$(gh release view "${RELEASE_TAG}" --repo "${GH_REPO}" --json assets | jq -r '.assets[].name')
          if echo "${ASSET_LIST}" | grep -Fxq "$ASSET"; then
            echo "asset=$ASSET" >> "$GITHUB_OUTPUT"
            echo "release_tag=${RELEASE_TAG}" >> "$GITHUB_OUTPUT"
            echo "exists=true" >> "$GITHUB_OUTPUT"
          else
            echo "exists=false" >> "$GITHUB_OUTPUT"
            echo "Asset $ASSET not found for ${RELEASE_TAG}, will skip."
          fi

      - name: Download asset
        if: steps.has_asset.outputs.exists == 'true'
        run: |
          set -euo pipefail
          mkdir -p "releases/${TAG}"
          gh release download "${{ steps.has_asset.outputs.release_tag }}" \
            --repo "${GH_REPO}" \
            --pattern "${{ steps.has_asset.outputs.asset }}" \
            --dir "releases/${TAG}"

      - name: Init SSH
        if: steps.has_asset.outputs.exists == 'true'
        run: |
          set -euo pipefail
          mkdir -p ~/.ssh
          echo "$RSYNC_SSH_KEY" > ~/.ssh/id_rsa
          chmod 600 ~/.ssh/id_rsa
          ssh-keyscan -H "$VPS_HOST" >> ~/.ssh/known_hosts

      - name: Rsync this asset to remote
        if: steps.has_asset.outputs.exists == 'true'
        run: |
          set -euo pipefail
          REMOTE_DIR="${REMOTE_ROOT}/${TAG}"
          ssh -i ~/.ssh/id_rsa "${RSYNC_SSH_USER}@${VPS_HOST}" "mkdir -p '${REMOTE_DIR}'"
          echo "Rsync releases/${TAG}/${{ steps.has_asset.outputs.asset }} -> ${VPS_HOST}:${REMOTE_DIR}/"
          rsync -av -e "ssh -i ~/.ssh/id_rsa" \
            "releases/${TAG}/${{ steps.has_asset.outputs.asset }}" "${RSYNC_SSH_USER}@${VPS_HOST}:${REMOTE_DIR}/"

  retention:
    name: Remote retention (keep latest 10 v0.*)
    needs: [prep, sync-one]
    if: needs.prep.outputs.exists == 'false'   # 只有新增版本时才清理
    runs-on: ubuntu-latest
    env:
      RSYNC_SSH_KEY: ${{ secrets.RSYNC_SSH_KEY }}
      RSYNC_SSH_USER: ${{ secrets.RSYNC_SSH_USER }}
      VPS_HOST: ${{ secrets.VPS_HOST }}
      REMOTE_ROOT: /data/update-server/otel/OpenTelemetry/
    steps:
      - name: Init SSH
        run: |
          set -euo pipefail
          mkdir -p ~/.ssh
          echo "$RSYNC_SSH_KEY" > ~/.ssh/id_rsa
          chmod 600 ~/.ssh/id_rsa
          ssh-keyscan -H "$VPS_HOST" >> ~/.ssh/known_hosts

      - name: Prune old versions on remote (keep 10)
        run: |
          set -euo pipefail
          ssh -i ~/.ssh/id_rsa "${RSYNC_SSH_USER}@${VPS_HOST}" bash -lc '
            set -euo pipefail
            cd "'"${REMOTE_ROOT}"'" || exit 0
            keep=10
            mapfile -t all < <(ls -1 | grep -E "^v0\.[0-9]+\.[0-9]+$" | sort -V -r || true)
            if [ "${#all[@]}" -le "$keep" ]; then
              echo "Nothing to prune. Count=${#all[@]}"
              exit 0
            fi
            to_delete=("${all[@]:keep}")
            echo "Pruning old versions: ${to_delete[*]}"
            for d in "${to_delete[@]}"; do
              rm -rf -- "$d"
            done
          '
