name: Update libarchive

permissions:
  contents: read

on:
  schedule:
    - cron: "0 3 * * 0"
  workflow_dispatch:

jobs:
  check-update:
    if: github.repository == 'oven-sh/bun'
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Check libarchive version
        id: check-version
        run: |
          set -euo pipefail

          DEP_FILE=scripts/build/deps/libarchive.ts
          CURRENT_VERSION=$(sed -nE 's/^const LIBARCHIVE_COMMIT = "([0-9a-f]{40})";$/\1/p' "$DEP_FILE")

          if [ -z "$CURRENT_VERSION" ]; then
            echo "Error: Could not find LIBARCHIVE_COMMIT in $DEP_FILE"
            exit 1
          fi

          # Validate that it looks like a git hash
          if ! [[ $CURRENT_VERSION =~ ^[0-9a-f]{40}$ ]]; then
            echo "Error: Invalid git hash format in $DEP_FILE"
            echo "Found: $CURRENT_VERSION"
            echo "Expected: 40 character hexadecimal string"
            exit 1
          fi

          echo "current=$CURRENT_VERSION" >> $GITHUB_OUTPUT

          LATEST_RELEASE=$(curl -sL https://api.github.com/repos/libarchive/libarchive/releases/latest)
          if [ -z "$LATEST_RELEASE" ]; then
            echo "Error: Failed to fetch latest release from GitHub API"
            exit 1
          fi

          LATEST_TAG=$(echo "$LATEST_RELEASE" | jq -r '.tag_name')
          if [ -z "$LATEST_TAG" ] || [ "$LATEST_TAG" = "null" ]; then
            echo "Error: Could not extract tag name from GitHub API response"
            exit 1
          fi

          LATEST_TAG_SHA=$(curl -sL "https://api.github.com/repos/libarchive/libarchive/git/refs/tags/$LATEST_TAG" | jq -r '.object.sha')
          if [ -z "$LATEST_TAG_SHA" ] || [ "$LATEST_TAG_SHA" = "null" ]; then
            echo "Error: Could not fetch SHA for tag $LATEST_TAG"
            exit 1
          fi
          LATEST_SHA=$(curl -sL "https://api.github.com/repos/libarchive/libarchive/git/tags/$LATEST_TAG_SHA" | jq -r '.object.sha')
          if [ -z "$LATEST_SHA" ] || [ "$LATEST_SHA" = "null" ]; then
            echo "Error: Could not fetch SHA for tag $LATEST_TAG @ $LATEST_TAG_SHA"
            exit 1
          fi

          if ! [[ $LATEST_SHA =~ ^[0-9a-f]{40}$ ]]; then
            echo "Error: Invalid SHA format received from GitHub"
            echo "Found: $LATEST_SHA"
            echo "Expected: 40 character hexadecimal string"
            exit 1
          fi

          echo "latest=$LATEST_SHA" >> $GITHUB_OUTPUT
          echo "tag=$LATEST_TAG" >> $GITHUB_OUTPUT

      - name: Update version if needed
        if: success() && steps.check-version.outputs.current != steps.check-version.outputs.latest
        env:
          LATEST: ${{ steps.check-version.outputs.latest }}
        run: |
          set -euo pipefail
          sed -i -E 's/^(const LIBARCHIVE_COMMIT = ")[0-9a-f]{40}(";)$/\1'"$LATEST"'\2/' scripts/build/deps/libarchive.ts

      - name: Create Pull Request
        if: success() && steps.check-version.outputs.current != steps.check-version.outputs.latest
        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          add-paths: |
            scripts/build/deps/libarchive.ts
          commit-message: "deps: update libarchive to ${{ steps.check-version.outputs.tag }} (${{ steps.check-version.outputs.latest }})"
          title: "deps: update libarchive to ${{ steps.check-version.outputs.tag }}"
          delete-branch: true
          branch: deps/update-libarchive
          body: |
            ## What does this PR do?

            Updates libarchive to version ${{ steps.check-version.outputs.tag }}

            Compare: https://github.com/libarchive/libarchive/compare/${{ steps.check-version.outputs.current }}...${{ steps.check-version.outputs.latest }}

            Auto-updated by [this workflow](https://github.com/oven-sh/bun/actions/workflows/update-libarchive.yml)