action.yml

name: 'Hookstore Re-verify Hook'
description: 'Automatically re-verify your Xahau Hook on Hookstore'
author: 'Hookstore'

branding:
  icon: 'check-circle'
  color: 'blue'

inputs:
  api_url:
    description: 'Hookstore API URL'
    required: false
    default: 'https://api.hookstore.xahau.network'
  api_key:
    description: 'Your Hookstore API key (generated in console settings)'
    required: true
  source_ref:
    description: 'Source reference (tag/branch/commit) - defaults to current ref or manifest version'
    required: false
  create_if_missing:
    description: 'Create a new release if hook exists but release does not'
    required: false
    default: 'false'
  wait_for_completion:
    description: 'Wait for verification to complete (polls status every 30s)'
    required: false
    default: 'false'
  timeout:
    description: 'Maximum time to wait for completion in seconds (default: 600 = 10 minutes)'
    required: false
    default: '600'

outputs:
  hook_slug:
    description: 'The hook slug that was re-verified'
    value: ${{ steps.reverify.outputs.hook_slug }}
  semver:
    description: 'The semantic version that was re-verified'
    value: ${{ steps.reverify.outputs.semver }}
  release_id:
    description: 'The release ID'
    value: ${{ steps.reverify.outputs.release_id }}
  created:
    description: 'Whether a new release was created'
    value: ${{ steps.reverify.outputs.created }}
  status:
    description: 'Verification status (queued, verified, failed, timeout)'
    value: ${{ steps.wait.outputs.status || steps.reverify.outputs.status }}

runs:
  using: 'composite'
  steps:
    - name: Determine source reference
      id: source_ref
      shell: bash
      run: |
        # Use manual input if provided, otherwise detect from context
        if [ -n "${{ inputs.source_ref }}" ]; then
          SOURCE_REF="${{ inputs.source_ref }}"
          echo "Using manual sourceRef: $SOURCE_REF"
        elif [ "${{ github.event_name }}" = "release" ]; then
          # Release event - use tag name
          SOURCE_REF="${{ github.event.release.tag_name }}"
          echo "Using release tag: $SOURCE_REF"
        elif [ "${{ github.ref_type }}" = "tag" ]; then
          # Tag push - use tag name
          SOURCE_REF="${{ github.ref_name }}"
          echo "Using pushed tag: $SOURCE_REF"
        else
          # Fallback: try to read from manifest, otherwise use commit SHA
          if [ -f "hookstore.manifest.json" ]; then
            MANIFEST_VERSION=$(jq -r '.version // empty' hookstore.manifest.json 2>/dev/null || echo "")
            # Check if manifest targets mainnet
            MANIFEST_NETWORKS=$(jq -r '.networks // []' hookstore.manifest.json 2>/dev/null || echo "[]")
            IS_MAINNET=$(echo "$MANIFEST_NETWORKS" | jq -r 'any(. == "xahau-mainnet" or . == "XAHAU_MAINNET")' 2>/dev/null || echo "false")
            
            if [ -n "$MANIFEST_VERSION" ]; then
              # Try to find a tag matching the version
              if git rev-parse "v$MANIFEST_VERSION" >/dev/null 2>&1; then
                SOURCE_REF="v$MANIFEST_VERSION"
                echo "Using tag matching manifest version: $SOURCE_REF"
              elif git rev-parse "$MANIFEST_VERSION" >/dev/null 2>&1; then
                SOURCE_REF="$MANIFEST_VERSION"
                echo "Using tag matching manifest version: $SOURCE_REF"
              else
                # No matching tag found
                if [ "$IS_MAINNET" = "true" ]; then
                  echo "⚠️ WARNING: Manifest targets mainnet but no matching tag found for version $MANIFEST_VERSION"
                  echo "⚠️ Mainnet releases require git tags. Please create a tag:"
                  echo "   git tag v$MANIFEST_VERSION && git push origin v$MANIFEST_VERSION"
                  echo "⚠️ Falling back to commit SHA, but this will fail for mainnet releases"
                fi
                # Use default branch (will fail validation for mainnet, but allow testnet)
                SOURCE_REF="main"
                echo "Using default branch (manifest version: $MANIFEST_VERSION will be used for semver)"
                if [ "$IS_MAINNET" = "true" ]; then
                  echo "⚠️ NOTE: This will fail validation for mainnet releases. Use a git tag instead."
                fi
              fi
            else
              if [ "$IS_MAINNET" = "true" ]; then
                echo "⚠️ WARNING: Manifest targets mainnet but no version found in manifest"
                echo "⚠️ Mainnet releases require git tags. Please specify source_ref input with a tag name"
              fi
              SOURCE_REF="${{ github.sha }}"
              echo "Using commit SHA: $SOURCE_REF"
              if [ "$IS_MAINNET" = "true" ]; then
                echo "⚠️ NOTE: This will fail validation for mainnet releases. Use a git tag instead."
              fi
            fi
          else
            SOURCE_REF="${{ github.sha }}"
            echo "Using commit SHA: $SOURCE_REF"
            echo "⚠️ NOTE: If your hook targets mainnet, this will fail. Use a git tag instead."
          fi
        fi
        
        # Validate sourceRef format for mainnet (heuristic check)
        # Check if it looks like a commit SHA (40 hex chars) or common branch name
        if echo "$SOURCE_REF" | grep -qE '^[0-9a-f]{40}$' -i; then
          echo "⚠️ WARNING: Source reference appears to be a commit SHA"
          echo "⚠️ If your hook targets mainnet, this will be rejected. Use a git tag instead."
        elif echo "$SOURCE_REF" | grep -qE '^(main|master|develop|dev|staging|production|prod)$' -i; then
          echo "⚠️ WARNING: Source reference appears to be a branch name"
          echo "⚠️ If your hook targets mainnet, this will be rejected. Use a git tag instead."
        fi
        
        echo "source_ref=$SOURCE_REF" >> $GITHUB_OUTPUT
        echo "📌 Source reference: $SOURCE_REF"

    - name: Get repository URL
      id: repo
      shell: bash
      run: |
        REPO_URL="${{ github.server_url }}/${{ github.repository }}"
        echo "repo_url=$REPO_URL" >> $GITHUB_OUTPUT
        echo "📦 Repository: $REPO_URL"

    - name: Trigger re-verification
      id: reverify
      shell: bash
      run: |
        echo "🚀 Triggering re-verification..."
        echo "Repository: ${{ steps.repo.outputs.repo_url }}"
        echo "Source Ref: ${{ steps.source_ref.outputs.source_ref }}"
        echo "Create if Missing: ${{ inputs.create_if_missing }}"
        
        # Build request body (only include sourceRef if provided)
        REQUEST_BODY="{"
        REQUEST_BODY="$REQUEST_BODY\"repoUrl\": \"${{ steps.repo.outputs.repo_url }}\""
        if [ -n "${{ steps.source_ref.outputs.source_ref }}" ]; then
          REQUEST_BODY="$REQUEST_BODY, \"sourceRef\": \"${{ steps.source_ref.outputs.source_ref }}\""
        fi
        if [ "${{ inputs.create_if_missing }}" = "true" ]; then
          REQUEST_BODY="$REQUEST_BODY, \"createIfMissing\": true"
        fi
        REQUEST_BODY="$REQUEST_BODY}"
        
        # Make API call to trigger re-verification
        RESPONSE=$(curl -s -w "\n%{http_code}" -X POST \
          "${{ inputs.api_url }}/reverify" \
          -H "Content-Type: application/json" \
          -H "Authorization: Bearer ${{ inputs.api_key }}" \
          -d "$REQUEST_BODY")
        
        # Extract HTTP status code (last line)
        HTTP_CODE=$(echo "$RESPONSE" | tail -n1)
        # Extract response body (everything except last line)
        BODY=$(echo "$RESPONSE" | sed '$d')
        
        echo "HTTP Status: $HTTP_CODE"
        echo "Response: $BODY"
        
        # Check if request was successful
        if [ "$HTTP_CODE" -ge 200 ] && [ "$HTTP_CODE" -lt 300 ]; then
          echo "✅ Re-verification triggered successfully"
          echo "response=$BODY" >> $GITHUB_OUTPUT
          
          # Extract hook slug and semver for polling
          HOOK_SLUG=$(echo "$BODY" | jq -r '.hookSlug // empty' 2>/dev/null || echo "")
          SEMVER=$(echo "$BODY" | jq -r '.semver // empty' 2>/dev/null || echo "")
          RELEASE_ID=$(echo "$BODY" | jq -r '.releaseId // empty' 2>/dev/null || echo "")
          CREATED=$(echo "$BODY" | jq -r '.created // false' 2>/dev/null || echo "false")
          
          if [ -n "$HOOK_SLUG" ]; then
            echo "hook_slug=$HOOK_SLUG" >> $GITHUB_OUTPUT
          fi
          if [ -n "$SEMVER" ]; then
            echo "semver=$SEMVER" >> $GITHUB_OUTPUT
          fi
          if [ -n "$RELEASE_ID" ]; then
            echo "release_id=$RELEASE_ID" >> $GITHUB_OUTPUT
          fi
          echo "created=$CREATED" >> $GITHUB_OUTPUT
          echo "status=queued" >> $GITHUB_OUTPUT
          echo "📦 Hook: $HOOK_SLUG@$SEMVER"
        else
          echo "❌ Re-verification failed with status $HTTP_CODE"
          echo "Response: $BODY"
          exit 1
        fi

    - name: Wait for verification completion
      id: wait
      if: steps.reverify.outcome == 'success' && inputs.wait_for_completion == 'true'
      shell: bash
      run: |
        HOOK_SLUG="${{ steps.reverify.outputs.hook_slug }}"
        SEMVER="${{ steps.reverify.outputs.semver }}"
        TIMEOUT=${{ inputs.timeout }}
        POLL_INTERVAL=30
        API_URL="${{ inputs.api_url }}"
        
        if [ -z "$HOOK_SLUG" ] || [ -z "$SEMVER" ]; then
          echo "⚠️ Could not extract hook slug or semver from response. Skipping polling."
          exit 0
        fi
        
        echo "⏳ Waiting for verification to complete..."
        echo "📦 Hook: $HOOK_SLUG@$SEMVER"
        echo "⏱️ Timeout: ${TIMEOUT}s (polling every ${POLL_INTERVAL}s)"
        echo ""
        
        START_TIME=$(date +%s)
        ELAPSED=0
        
        while [ $ELAPSED -lt $TIMEOUT ]; do
          # Poll status endpoint (public API, no auth needed)
          STATUS_RESPONSE=$(curl -s "$API_URL/hooks/$HOOK_SLUG/releases/$SEMVER/verification-status" || echo "{}")
          STATUS=$(echo "$STATUS_RESPONSE" | jq -r '.status // "unknown"')
          VERIFIED=$(echo "$STATUS_RESPONSE" | jq -r '.verified // false')
          ERROR=$(echo "$STATUS_RESPONSE" | jq -r '.verifyError // empty')
          
          CURRENT_TIME=$(date +%s)
          ELAPSED=$((CURRENT_TIME - START_TIME))
          
          echo "[${ELAPSED}s] Status: $STATUS"
          
          case "$STATUS" in
            verified)
              echo "✅ Verification completed successfully!"
              echo "status=$STATUS" >> $GITHUB_OUTPUT
              echo "verified=true" >> $GITHUB_OUTPUT
              exit 0
              ;;
            failed|invalidated)
              echo "❌ Verification failed: $STATUS"
              if [ -n "$ERROR" ]; then
                echo "Error: $ERROR"
                echo "error=$ERROR" >> $GITHUB_OUTPUT
              fi
              echo "status=$STATUS" >> $GITHUB_OUTPUT
              echo "verified=false" >> $GITHUB_OUTPUT
              exit 1
              ;;
            building|unverified)
              # Still in progress, continue polling
              echo "⏳ Still building... (${ELAPSED}/${TIMEOUT}s)"
              ;;
            *)
              echo "⚠️ Unknown status: $STATUS"
              ;;
          esac
          
          # Wait before next poll
          sleep $POLL_INTERVAL
          ELAPSED=$((CURRENT_TIME + POLL_INTERVAL - START_TIME))
        done
        
        echo "⏱️ Timeout reached after ${TIMEOUT}s"
        echo "❌ Verification did not complete in time. Final status: $STATUS"
        echo "status=timeout" >> $GITHUB_OUTPUT
        echo "verified=false" >> $GITHUB_OUTPUT
        exit 1