#!/usr/bin/env bash

set -euo pipefail

GITCODE_API_BASE="${GITCODE_API_BASE:-https://api.gitcode.com/api/v5}"

GITHUB_REPOSITORY_NAME="${GITHUB_REPOSITORY:-moeru-ai/airi}"

RELEASE_TAG="${GITCODE_RELEASE_TAG:-${RELEASE_TAG:-${GITHUB_REF_NAME:-}}}"

GITCODE_TARGET_COMMITISH="${GITCODE_TARGET_COMMITISH:-main}"

WORK_DIR="${RUNNER_TEMP:-/tmp}/gitcode-release-${RELEASE_TAG}"

ASSETS_DIR="${WORK_DIR}/assets"

if [[ -z "${RELEASE_TAG}" ]]; then

echo "::error::Missing release tag. Set GITCODE_RELEASE_TAG or run from a release tag ref."

exit 1

fi

# Ensures required environment variables are present before any network call.

require_env() {

local name="$1"

if [[ -z "${!name:-}" ]]; then

echo "::error::Missing required environment variable: ${name}"

exit 1

fi

}

# Encodes a single path component for GitCode query parameters.

urlencode() {

jq -nr --arg value "$1" '$value | @uri'

}

# Formats a value for curl's config file syntax.

curl_config_value() {

jq -Rr @json <<< "$1"

}

# Writes a curl config file for GitCode API calls without putting the token in

# the process argument list.

write_gitcode_curl_config() {

local path="$1"

local config_file="$2"

{

printf 'url = %s\n' "$(curl_config_value "${GITCODE_API_BASE}${path}")"

printf 'url-query = %s\n' "$(curl_config_value "access_token=${GITCODE_TOKEN}")"

} > "${config_file}"

chmod 600 "${config_file}"

}

# Reads GitHub release metadata and creates the same GitCode release when absent.

ensure_gitcode_release() {

local github_release_json="${WORK_DIR}/github-release.json"

local gitcode_release_json="${WORK_DIR}/gitcode-release.json"

local response_json="${WORK_DIR}/create-release-response.json"

local request_config="${WORK_DIR}/create-release-request.curlrc"

local http_status

gh release view "${RELEASE_TAG}" \

--repo "${GITHUB_REPOSITORY_NAME}" \

--json tagName,name,body,isPrerelease \

> "${github_release_json}"

jq --arg target_commitish "${GITCODE_TARGET_COMMITISH}" '{

tag_name: .tagName,

name: .name,

body: .body,

target_commitish: $target_commitish,

release_status: (if .isPrerelease then "pre" else "latest" end)

}' "${github_release_json}" > "${gitcode_release_json}"

write_gitcode_curl_config "/repos/${GITCODE_OWNER}/${GITCODE_REPO}/releases" "${request_config}"

http_status="$(

curl --retry 3 --retry-all-errors -sS \

--config "${request_config}" \

-o "${response_json}" \

-w '%{http_code}' \

-X POST \

-H 'Content-Type: application/json' \

--data @"${gitcode_release_json}"

)"

if [[ "${http_status}" =~ ^2 ]]; then

echo "Created GitCode release ${RELEASE_TAG}."

return

fi

if jq -e '.error_code == 409 or (.error_message // "" | contains("Release already exists"))' "${response_json}" >/dev/null 2>&1; then

echo "GitCode release ${RELEASE_TAG} already exists; reusing it."

return

fi

echo "::error::Failed to create GitCode release ${RELEASE_TAG}; HTTP ${http_status}."

exit 1

}

# Fetches the current GitCode release assets so repeated workflow runs can skip

# files that were already mirrored.

write_existing_gitcode_asset_names() {

local release_json="${WORK_DIR}/gitcode-release-current.json"

local request_config="${WORK_DIR}/get-release-request.curlrc"

local encoded_tag

encoded_tag="$(urlencode "${RELEASE_TAG}")"

write_gitcode_curl_config "/repos/${GITCODE_OWNER}/${GITCODE_REPO}/releases/tags/${encoded_tag}" "${request_config}"

curl --retry 3 --retry-all-errors -fsS \

--config "${request_config}" \

> "${release_json}"

jq -r '.assets[]?.name' "${release_json}" | sort > "${WORK_DIR}/existing-gitcode-assets.txt"

}

# Writes the GitHub release assets that should be mirrored to GitCode.

write_expected_github_asset_metadata() {

local release_assets_json="${WORK_DIR}/github-release-assets.json"

local encoded_tag

encoded_tag="$(urlencode "${RELEASE_TAG}")"

gh api "repos/${GITHUB_REPOSITORY_NAME}/releases/tags/${encoded_tag}" \

> "${release_assets_json}"

jq -r '.assets[].name | select(test("^(AIRI-.*|latest-.*\\.yml)$"))' "${release_assets_json}" \

| sort \

> "${WORK_DIR}/expected-asset-names.txt"

jq -r '.assets[] | select(.name | test("^(AIRI-.*|latest-.*\\.yml)$")) | [.name, (.digest // "")] | @tsv' "${release_assets_json}" \

| sort \

> "${WORK_DIR}/expected-asset-digests.tsv"

if [[ ! -s "${WORK_DIR}/expected-asset-names.txt" ]]; then

echo "::error::No GitHub release assets matched AIRI-* or latest-*.yml."

exit 1

fi

if awk -F '\t' '$2 == "" { found = 1 } END { exit found ? 0 : 1 }' "${WORK_DIR}/expected-asset-digests.tsv"; then

echo "::error::GitHub release assets are missing SHA-256 digests; cannot verify GitCode mirror freshness."

exit 1

fi

}

# Builds the public GitCode release download URL for an uploaded asset.

gitcode_download_url() {

local filename="$1"

local encoded_filename

local encoded_tag

encoded_filename="$(urlencode "${filename}")"

encoded_tag="$(urlencode "${RELEASE_TAG}")"

printf 'https://gitcode.com/%s/%s/releases/download/%s/%s' \

"${GITCODE_OWNER}" \

"${GITCODE_REPO}" \

"${encoded_tag}" \

"${encoded_filename}"

}

# Reads a GitCode asset SHA-256 digest by streaming the public download.

read_gitcode_asset_digest() {

local filename="$1"

local download_url

download_url="$(gitcode_download_url "${filename}")"

curl --retry 3 --retry-all-errors -fsSL "${download_url}" \

| sha256sum \

| awk '{ print "sha256:" $1 }'

}

# Verifies same-name GitCode assets still match the GitHub release asset digests.

verify_gitcode_asset_digests() {

local mode="${1:-strict}"

local stale_assets="${WORK_DIR}/stale-gitcode-assets.tsv"

local stale_names="${WORK_DIR}/stale-gitcode-asset-names.txt"

local filename

local expected_digest

local actual_digest

: > "${stale_assets}"

: > "${stale_names}"

while IFS=$'\t' read -r filename expected_digest; do

if ! grep -Fxq "${filename}" "${WORK_DIR}/existing-gitcode-assets.txt"; then

continue

fi

if ! actual_digest="$(read_gitcode_asset_digest "${filename}")"; then

echo "::error::Could not read GitCode asset digest for ${filename}."

exit 1

fi

if [[ -z "${actual_digest}" ]]; then

echo "::error::Could not read GitCode asset digest for ${filename}."

exit 1

fi

if [[ "${actual_digest}" != "${expected_digest}" ]]; then

printf '%s\t%s\t%s\n' "${filename}" "${expected_digest}" "${actual_digest}" >> "${stale_assets}"

printf '%s\n' "${filename}" >> "${stale_names}"

fi

done < "${WORK_DIR}/expected-asset-digests.tsv"

if [[ -s "${stale_assets}" ]]; then

if [[ "${mode}" == "warn" ]]; then

echo "::warning::GitCode release contains stale mirrored assets; they will be uploaded again:"

else

echo "::error::GitCode release contains stale mirrored assets with digest mismatches:"

fi

awk -F '\t' '{ printf " - %s: GitHub=%s, GitCode=%s\n", $1, $2, $3 }' "${stale_assets}"

if [[ "${mode}" == "warn" ]]; then

sort -u -o "${stale_names}" "${stale_names}"

return

fi

echo "::error::GitCode release still has stale mirrored assets after upload."

exit 1

fi

}

# Checks whether an existing GitCode asset should be replaced by the GitHub one.

is_stale_gitcode_asset() {

local filename="$1"

local stale_names="${WORK_DIR}/stale-gitcode-asset-names.txt"

[[ -s "${stale_names}" ]] && grep -Fxq "${filename}" "${stale_names}"

}

# Downloads GitHub release assets that are missing from GitCode or stale there.

download_missing_github_release_assets() {

local missing_names="${WORK_DIR}/missing-before-upload.txt"

local stale_names="${WORK_DIR}/stale-gitcode-asset-names.txt"

local upload_names="${WORK_DIR}/asset-names-to-upload.txt"

rm -rf "${ASSETS_DIR}"

mkdir -p "${ASSETS_DIR}"

comm -23 "${WORK_DIR}/expected-asset-names.txt" "${WORK_DIR}/existing-gitcode-assets.txt" > "${missing_names}"

{

cat "${missing_names}"

if [[ -s "${stale_names}" ]]; then

cat "${stale_names}"

fi

} | sort -u > "${upload_names}"

if [[ ! -s "${upload_names}" ]]; then

echo "GitCode release ${RELEASE_TAG} already has every mirrored asset."

: > "${WORK_DIR}/assets-to-upload.txt"

return

fi

while IFS= read -r filename; do

gh release download "${RELEASE_TAG}" \

--repo "${GITHUB_REPOSITORY_NAME}" \

--pattern "${filename}" \

--dir "${ASSETS_DIR}" \

--clobber

done < "${upload_names}"

find "${ASSETS_DIR}" -maxdepth 1 -type f -print | sort > "${WORK_DIR}/assets-to-upload.txt"

}

# Uploads one local asset through GitCode's pre-signed OBS upload URL.

upload_asset() {

local file="$1"

local filename

local encoded_filename

local upload_json

local upload_url

local upload_url_status

local response_body

local http_status

local x_obs_acl

local x_obs_callback

local x_obs_meta_project_id

local x_obs_content_type

local request_config

local encoded_tag

filename="$(basename "${file}")"

if grep -Fxq "${filename}" "${WORK_DIR}/existing-gitcode-assets.txt" && ! is_stale_gitcode_asset "${filename}"; then

echo "Skipping existing GitCode asset: ${filename}"

return

fi

echo "Uploading GitCode asset: ${filename}"

encoded_filename="$(urlencode "${filename}")"

encoded_tag="$(urlencode "${RELEASE_TAG}")"

upload_json="${WORK_DIR}/upload-${filename}.json"

response_body="${WORK_DIR}/upload-${filename}.response"

request_config="${WORK_DIR}/upload-url-${filename}.curlrc"

write_gitcode_curl_config "/repos/${GITCODE_OWNER}/${GITCODE_REPO}/releases/${encoded_tag}/upload_url?file_name=${encoded_filename}" "${request_config}"

upload_url_status="$(

curl --retry 3 --retry-all-errors -sS \

--config "${request_config}" \

-o "${upload_json}" \

-w '%{http_code}'

)"

if [[ ! "${upload_url_status}" =~ ^2 ]]; then

write_existing_gitcode_asset_names

if grep -Fxq "${filename}" "${WORK_DIR}/existing-gitcode-assets.txt" && ! is_stale_gitcode_asset "${filename}"; then

echo "Skipping concurrently uploaded GitCode asset: ${filename}"

return

fi

echo "::error::Failed to prepare GitCode upload URL for ${filename}; HTTP ${upload_url_status}."

exit 1

fi

{

IFS=$'\t' read -r upload_url x_obs_meta_project_id x_obs_acl x_obs_callback x_obs_content_type

} < <(

jq -r '[

.url,

.headers["x-obs-meta-project-id"],

.headers["x-obs-acl"],

.headers["x-obs-callback"],

.headers["Content-Type"]

] | @tsv' "${upload_json}"

)

http_status="$(

curl --retry 3 --retry-all-errors -sS \

-o "${response_body}" \

-w '%{http_code}' \

-X PUT \

-H "x-obs-meta-project-id: ${x_obs_meta_project_id}" \

-H "x-obs-acl: ${x_obs_acl}" \

-H "x-obs-callback: ${x_obs_callback}" \

-H "Content-Type: ${x_obs_content_type}" \

--upload-file "${file}" \

"${upload_url}"

)"

if [[ ! "${http_status}" =~ ^2 ]]; then

write_existing_gitcode_asset_names

if grep -Fxq "${filename}" "${WORK_DIR}/existing-gitcode-assets.txt" && ! is_stale_gitcode_asset "${filename}"; then

echo "GitCode asset appeared after upload retry: ${filename}"

return

fi

echo "::error::Failed to upload ${filename} to GitCode; HTTP ${http_status}."

exit 1

fi

}

# Verifies every downloaded GitHub release asset is visible in the GitCode

# release after upload.

verify_gitcode_release_assets() {

local current_names="${WORK_DIR}/gitcode-asset-names-after-upload.txt"

local missing_names="${WORK_DIR}/missing-gitcode-assets.txt"

write_existing_gitcode_asset_names

cp "${WORK_DIR}/existing-gitcode-assets.txt" "${current_names}"

comm -23 "${WORK_DIR}/expected-asset-names.txt" "${current_names}" > "${missing_names}"

if [[ -s "${missing_names}" ]]; then

echo "::error::GitCode release is missing mirrored assets:"

sed 's/^/ - /' "${missing_names}"

exit 1

fi

verify_gitcode_asset_digests

echo "GitCode release ${RELEASE_TAG} contains all mirrored assets."

}

# Runs the full GitHub Release to GitCode Release mirror flow.

main() {

require_env GH_TOKEN

require_env GITCODE_TOKEN

require_env GITCODE_OWNER

require_env GITCODE_REPO

mkdir -p "${WORK_DIR}"

ensure_gitcode_release

write_existing_gitcode_asset_names

write_expected_github_asset_metadata

verify_gitcode_asset_digests warn

download_missing_github_release_assets

while IFS= read -r file; do

upload_asset "${file}"

done < "${WORK_DIR}/assets-to-upload.txt"

verify_gitcode_release_assets

}

main "$@"