name: Promote release

# node-26#49: move the major tag (v1) to a tested release. Customer nodes
# (updater REF=v1) install it on their next timer run, because its version is
# numerically higher than what they run. Never moves it backwards.

on:
  workflow_dispatch:
    inputs:
      version:
        description: "Release to promote, e.g. 1.1.3 (must already be tagged v1.1.3)"
        required: true

jobs:
  promote:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Move the major tag
        env:
          VERSION: ${{ inputs.version }}
        run: |
          [[ "$VERSION" =~ ^([0-9]+)\.[0-9]+\.[0-9]+$ ]] || { echo "version must be MAJOR.MINOR.PATCH, got '$VERSION'"; exit 1; }
          MAJOR="${BASH_REMATCH[1]}"
          git fetch --force --tags origin
          git rev-parse -q --verify "refs/tags/v$VERSION" >/dev/null || { echo "tag v$VERSION does not exist"; exit 1; }
          # Refuse to go backwards: compare with the release v$MAJOR points at now.
          CUR="$(git tag --points-at "v$MAJOR" 2>/dev/null | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' \
                 | sed 's/^v//' | sort -t. -k1,1n -k2,2n -k3,3n | tail -1 || true)"
          if [ -n "$CUR" ]; then
            HIGHEST="$(printf '%s\n%s\n' "$CUR" "$VERSION" | sort -t. -k1,1n -k2,2n -k3,3n | tail -1)"
            [ "$HIGHEST" = "$VERSION" ] || { echo "v$MAJOR is at $CUR, newer than $VERSION — refusing to roll back here"; exit 1; }
          fi
          git tag -f "v$MAJOR" "v$VERSION^{commit}"
          git push --force origin "refs/tags/v$MAJOR"
          echo "v$MAJOR -> $VERSION (was ${CUR:-untagged})"