update-sqlite3mc.yml

name: Update SQLite3MC (Manual)

on:
  workflow_dispatch:
    inputs:
      version:
        description: "SQLite3MC version (e.g. 2.3.4)"
        required: true
        type: string
      mode:
        description: "Update mode"
        required: true
        type: choice
        default: dry-run
        options:
          - sanity
          - dry-run
          - update

permissions:
  contents: read

concurrency:
  group: update-sqlite-${{ github.ref }}
  cancel-in-progress: false

jobs:

  update:
    name: Update version information and SQLite3MC sources
    runs-on: ubuntu-latest
    permissions:
      contents: write   # commits & pushes updated SQLite3MC sources
      attestations: read
      id-token: write
    env:
      MODE: ${{ github.event.inputs.mode }}

    steps:

      # -------------------------------------------------
      # Checkout repository
      # -------------------------------------------------
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      # -------------------------------------------------
      # Setup Python
      # -------------------------------------------------
      - name: Setup Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      # -------------------------------------------------
      # Validate version format
      # -------------------------------------------------
      - name: Validate version format
        env:
          VERSION: ${{ inputs.version }}
        run: |
          set -euo pipefail
          python3 scripts/validate_version.py "${{ inputs.version }}"

      # -------------------------------------------------
      # Resolve release asset
      # Locate release asset for SQLite3MC amalgamation
      # -------------------------------------------------
      - name: Resolve release asset (locked)
        id: asset
        env:
          GH_TOKEN: ${{ github.token }}
          VERSION: ${{ inputs.version }}
        shell: bash
        run: |
          set -euo pipefail

          TAG="v${VERSION}"

          echo "Resolving release for tag: $TAG"

          mapfile -t ASSETS < <(
            gh release view "$TAG" \
              --repo utelle/SQLite3MultipleCiphers \
              --json assets \
              --jq '
                .assets[].name
                | select(test("^sqlite3mc-'"${VERSION}"'-sqlite-[0-9.]+-amalgamation\\.zip$"))
              '
          )

          if [ "${#ASSETS[@]}" -ne 1 ]; then
            echo "ERROR: Expected exactly 1 matching asset, found ${#ASSETS[@]}" >&2
            printf '%s\n' "${ASSETS[@]:-}"
            exit 1
          fi

          ASSET_NAME="${ASSETS[0]}"

          echo "asset_name=$ASSET_NAME" >> "$GITHUB_OUTPUT"

      # -------------------------------------------------
      # Download release asset for SQLite3MC amalgamation
      # -------------------------------------------------
      - name: Download release asset
        env:
          GH_TOKEN: ${{ github.token }}
          VERSION: ${{ inputs.version }}
        run: |
          set -euo pipefail

          mkdir -p download

          gh release download "v${VERSION}" \
            --repo utelle/SQLite3MultipleCiphers \
            --pattern "${{ steps.asset.outputs.asset_name }}" \
            --dir download

      # -------------------------------------------------
      # Verify GitHub Attestation
      # --signer-workflow pins the trusted builder identity: only artifacts
      # attested by the reusable build-reusable.yml workflow of the
      # SQLite3MultipleCiphers repo are accepted (not just any workflow of
      # that repo).
      # -------------------------------------------------
      - name: Verify GitHub Attestation
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          FILE="download/${{ steps.asset.outputs.asset_name }}"
          echo "Verifying GitHub attestation for $FILE"
          gh attestation verify "$FILE" \
            --repo utelle/SQLite3MultipleCiphers
          #gh attestation verify "$FILE" \
          #  --repo utelle/SQLite3MultipleCiphers \
          #  --signer-workflow utelle/SQLite3MultipleCiphers/.github/workflows/build-reusable.yml
          echo "Attestation verification successful"

      # -------------------------------------------------
      # Extract amalgamation archive
      # -------------------------------------------------
      - name: Extract amalgamation archive
        run: |
          set -euo pipefail

          mkdir extracted

          unzip \
            "download/${{ steps.asset.outputs.asset_name }}" \
            -d extracted

      # -------------------------------------------------
      # Replace SQLite3MC source files
      # -------------------------------------------------
      - name: Replace SQLite3MC source files
        run: |
          set -euo pipefail

          # Check that directory sqlite3mc exists
          test -d sqlite3mc

          # Check that all needed files were extracted
          test -f extracted/sqlite3mc_amalgamation.c
          test -f extracted/sqlite3mc_amalgamation.h
          test -f extracted/shell3mc_amalgamation.c
          test -f extracted/sqlite3ext.h

          # Check that previous versions exist
          test -f sqlite3mc/sqlite3.c
          test -f sqlite3mc/sqlite3.h
          test -f sqlite3mc/shell.c
          test -f sqlite3mc/sqlite3ext.h

          # Replace source files by new versions
          cp -T extracted/sqlite3mc_amalgamation.c sqlite3mc/sqlite3.c
          cp -T extracted/sqlite3mc_amalgamation.h sqlite3mc/sqlite3.h
          cp -T extracted/shell3mc_amalgamation.c sqlite3mc/shell.c
          cp -T extracted/sqlite3ext.h sqlite3mc/sqlite3ext.h

      # -------------------------------------------------
      # Update versioninfo.json
      # -------------------------------------------------
      - name: Update versioninfo.json
        env:
          VERSION: ${{ inputs.version }}
        run: |
          set -euo pipefail
          python3 scripts/update_versioninfo.py \
            "${{ inputs.version }}" \
            bld/versioninfo.json

      # -------------------------------------------------
      # GIT + GPG SETUP incl. dry-run validation (composite action;
      # skipped entirely in sanity mode). The dry-run validation now uses an
      # empty signed commit + `git verify-commit` — the same mechanism the
      # update mode actually relies on (git commit -S), and the same
      # validation as in release.yml.
      # -------------------------------------------------
      - name: Set up GPG signing
        if: ${{ inputs.mode != 'sanity' }}
        uses: ./.github/actions/setup-signing
        with:
          git-user-name: ${{ vars.GIT_USER_NAME }}
          git-user-email: ${{ vars.GIT_USER_EMAIL }}
          gpg-key-id: ${{ vars.GPG_KEY_ID }}
          gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
          validate: ${{ inputs.mode == 'dry-run' }}

      # -------------------------------------------------
      # Commit changed source files and configuration (only update)
      # -------------------------------------------------
      - name: Commit changes
        if: ${{ inputs.mode == 'update' }}
        env:
          VERSION: ${{ inputs.version }}
        shell: bash
        run: |
          set -euo pipefail

          git add \
            sqlite3mc/sqlite3.c \
            sqlite3mc/sqlite3.h \
            sqlite3mc/sqlite3ext.h \
            sqlite3mc/shell.c \
            bld/versioninfo.json

          if git diff --cached --quiet; then
            echo "No changes detected"
            exit 0
          fi

          git commit -S -m "Update SQLite3MC to ${VERSION}"
          git push