name: Verify pinned Cloud Relay

on:
  workflow_dispatch:
    inputs:
      relay_core_tag:
        description: Exact published Relay Core tag, for example relaycore/v0.1.0
        required: true
        type: string

permissions:
  contents: read

concurrency:
  group: cloud-relay-${{ inputs.relay_core_tag }}
  cancel-in-progress: false

jobs:
  verify:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: relay
    env:
      GOWORK: 'off'
      CGO_ENABLED: '1'
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-go@v6
        with:
          go-version-file: relay/go.mod
          cache-dependency-path: relay/go.sum

      - name: Require an immutable released Relay Core dependency
        shell: pwsh
        env:
          RELAY_CORE_TAG: ${{ inputs.relay_core_tag }}
        run: |
          if ($env:RELAY_CORE_TAG -notmatch '^relaycore/v[0-9]+\.[0-9]+\.[0-9]+$') {
            throw 'relay_core_tag must be an exact relaycore/vX.Y.Z tag'
          }
          if (Select-String -Path go.mod -Pattern '^replace\s' -Quiet) {
            throw 'Cloud Relay go.mod must not contain replace directives'
          }
          $expected = $env:RELAY_CORE_TAG.Substring('relaycore/'.Length)
          $actual = (go list -m -f '{{.Version}}' github.com/klarkxy/nekonest/relaycore).Trim()
          if ($actual -ne $expected) {
            throw "go.mod requires $actual but workflow requested $expected"
          }
          go mod download

      - name: Test, vet, race, and build
        run: |
          go test -count=1 ./...
          go vet ./...
          go test -race -count=1 ./...
          go build -trimpath -o ../release/nekonest-cloud-relay ./cmd/relay

      - name: Record source provenance
        shell: pwsh
        env:
          RELAY_CORE_TAG: ${{ inputs.relay_core_tag }}
        run: |
          $cloudCommit = (git -C .. rev-parse HEAD).Trim()
          $binaryHash = (Get-FileHash ../release/nekonest-cloud-relay -Algorithm SHA256).Hash.ToLowerInvariant()
          [ordered]@{
            cloud_commit = $cloudCommit
            relay_core_tag = $env:RELAY_CORE_TAG
            binary_sha256 = $binaryHash
            built_at = (Get-Date).ToUniversalTime().ToString('o')
          } | ConvertTo-Json -Compress | Set-Content -Encoding utf8NoBOM ../release/cloud-relay-provenance.json

      - uses: actions/upload-artifact@v7
        with:
          name: nekonest-cloud-relay-${{ github.run_id }}
          path: |
            release/nekonest-cloud-relay
            release/cloud-relay-provenance.json
          if-no-files-found: error
          retention-days: 7