release.yml

name: Validate Release

on:
  workflow_call:
    inputs:
      tag:
        description: 'Release tag, for example v0.1.0'
        required: true
        type: string
  push:
    tags:
      - 'v*.*.*'
  workflow_dispatch:
    inputs:
      tag:
        description: 'Release tag, for example v0.1.0'
        required: true
        type: string

permissions:
  contents: read

jobs:
  release:
    # A fork may push a v* tag or dispatch this workflow while developing. Keep
    # upstream's release validation intact without treating fork tags as releases.
    if: ${{ github.repository == 'unraid/ci-runner-farm' }}
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
        with:
          ref: ${{ inputs.tag || github.ref }}

      - name: Validate plugin metadata
        shell: bash
        env:
          RELEASE_TAG: ${{ inputs.tag || github.ref_name }}
        run: |
          set -euo pipefail
          tag="${RELEASE_TAG}"
          plg="ci-runner-farm.plg"

          if [[ ! "$tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]]; then
            echo "Release tags must use SemVer format, for example v0.1.0: $tag" >&2
            exit 1
          fi
          internal_version="${tag#v}"

          plg_entity() { sed -n "s/^<!ENTITY $1[[:space:]]*\"\([^\"]*\)\">$/\1/p" "$plg"; }

          plugin_version="$(plg_entity pluginVersion)"
          if [[ "$plugin_version" != "$internal_version" ]]; then
            echo "Tag $tag does not match PLG pluginVersion $plugin_version" >&2
            exit 1
          fi

          release_tag="$(plg_entity releaseTag)"
          if [[ "$release_tag" != "$tag" ]]; then
            echo "Tag $tag does not match PLG releaseTag $release_tag" >&2
            exit 1
          fi

          plg_version="$(plg_entity version)"
          if [[ ! "$plg_version" =~ ^[0-9]{4}\.[0-9]{2}\.[0-9]{2}\.[0-9]{4}\.[0-9]+- ]]; then
            echo "PLG version must use build format YYYY.MM.DD.HHMM.BUILD-${internal_version}: $plg_version" >&2
            exit 1
          fi
          if [[ "${plg_version#*-}" != "$internal_version" ]]; then
            echo "PLG version must end with exact internal version ${internal_version}: $plg_version" >&2
            exit 1
          fi

          version_file="$(tr -d '[:space:]' < VERSION)"
          if [[ "$version_file" != "$internal_version" ]]; then
            echo "VERSION file ($version_file) does not match tag $tag" >&2
            exit 1
          fi

          python3 -c "import xml.etree.ElementTree as ET; ET.parse('$plg')"

          # Rebuild the package reproducibly from the tagged src. Its MD5 must
          # match the packageMD5 the committed .plg advertises (proving publish
          # will upload matching bytes), and its contents must match the source
          # tree at this commit (proving the .plg fetches the tagged plugin code).
          tgz="ci-runner-farm.tgz"
          chmod +x build-plg.sh
          ./build-plg.sh --tgz-only
          plg_md5="$(sed -n 's/^<!ENTITY packageMD5[[:space:]]*"\([0-9a-f]*\)">$/\1/p' "$plg")"
          tgz_md5="$(md5sum "$tgz" | cut -d' ' -f1)"
          if [[ -z "$plg_md5" || "$plg_md5" != "$tgz_md5" ]]; then
            echo "packageMD5 in $plg ($plg_md5) does not match $tgz ($tgz_md5) at $tag" >&2
            exit 1
          fi
          rm -rf /tmp/plgtree && mkdir -p /tmp/plgtree
          tar -xzf "$tgz" -C /tmp/plgtree
          if ! diff -r /tmp/plgtree src/usr/local/emhttp/plugins/ci-runner-farm; then
            echo "PLG package ($tgz) does not match src/ at $tag" >&2
            exit 1
          fi

          echo "Validated $plg + $tgz for $tag (version $plg_version, package md5 $tgz_md5)"