name: Move Stable Tag

on:
  workflow_call:
    inputs:
      release_tag:
        description: "The release tag name (e.g., 1.2.3)"
        required: true
        type: string
      commit_sha:
        description: "The commit SHA to point the stable tag to"
        required: true
        type: string
      is_prerelease:
        description: "Whether this is a prerelease (stable tag won't be moved for prereleases)"
        required: false
        type: boolean
        default: false
      make_latest:
        description: "Whether to move stable tag (from GitHub release 'Set as the latest release' option)"
        required: false
        type: boolean
        default: false

permissions:
  contents: read

# Prevent concurrent stable tag operations to avoid race conditions
concurrency:
  group: move-stable-tag-${{ github.repository }}
  cancel-in-progress: true

jobs:
  move-stable-tag:
    name: Move stable tag to release
    runs-on: ubuntu-latest
    timeout-minutes: 10 # Prevent hung git operations
    permissions:
      contents: write # Required to push tags
    # Only move stable tag for non-prerelease versions AND when make_latest is true
    if: ${{ !inputs.is_prerelease && inputs.make_latest }}
    steps:
      - name: Harden the runner
        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
        with:
          egress-policy: audit

      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0 # Full history needed for tag operations

      - name: Validate inputs
        env:
          RELEASE_TAG: ${{ inputs.release_tag }}
          COMMIT_SHA: ${{ inputs.commit_sha }}
        run: |
          set -euo pipefail

          # Validate release tag format
          if [[ ! "$RELEASE_TAG" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.-]+)?(\+[a-zA-Z0-9.-]+)?$ ]]; then
            echo "❌ Error: Invalid release tag format. Expected format: 1.2.3, 1.2.3-alpha"
            echo "Provided: $RELEASE_TAG"
            exit 1
          fi

          # Validate commit SHA format (40 character hex)
          if [[ ! "$COMMIT_SHA" =~ ^[a-f0-9]{40}$ ]]; then
            echo "❌ Error: Invalid commit SHA format. Expected 40 character hex string"
            echo "Provided: $COMMIT_SHA"
            exit 1
          fi

          echo "✅ Input validation passed"
          echo "Release tag: $RELEASE_TAG"
          echo "Commit SHA: $COMMIT_SHA"

      - name: Move stable tag
        env:
          RELEASE_TAG: ${{ inputs.release_tag }}
          COMMIT_SHA: ${{ inputs.commit_sha }}
        run: |
          set -euo pipefail

          # Configure git
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

          # Verify the commit exists
          if ! git cat-file -e "$COMMIT_SHA"; then
            echo "❌ Error: Commit $COMMIT_SHA does not exist in this repository"
            exit 1
          fi

          # Move stable tag to the release commit
          echo "📌 Moving stable tag to commit: $COMMIT_SHA (release: $RELEASE_TAG)"
          git tag -f stable "$COMMIT_SHA"
          git push origin stable --force

          echo "✅ Successfully moved stable tag to release $RELEASE_TAG"
          echo "🔗 Stable tag now points to: https://github.com/${{ github.repository }}/commit/$COMMIT_SHA"
