name: Expedited Release Audit

on:
  push:
    tags: ['v*']
  workflow_dispatch:
    inputs:
      tag:
        description: Release tag to audit
        required: true
        type: string

permissions:
  contents: read
  issues: write

jobs:
  audit:
    runs-on: ubuntu-latest
    env:
      TAG: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}

    steps:
      - name: Checkout
        # Pinned to an immutable commit: this job holds an issues-write token.
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          fetch-depth: 0

      - name: Fetch dev
        run: git fetch origin dev

      - name: Audit release path
        env:
          GH_TOKEN: ${{ github.token }}
          ACTOR: ${{ github.actor }}
          TRIGGER_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
        run: |
          set -euo pipefail

          # Release App triggers on v*, but only semver tags are releases.
          # Stray tags (e.g. vffe6fee-dev) must not open audit issues.
          if [[ ! "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "$TAG is not a semver release tag; skipping" >> "$GITHUB_STEP_SUMMARY"
            exit 0
          fi

          if git merge-base --is-ancestor "$(git rev-list -n1 "$TAG")" origin/dev; then
            echo "PR-first release; tag commit is on dev; no action" >> "$GITHUB_STEP_SUMMARY"
            exit 0
          fi

          existing_issue="$(gh issue list \
            --repo "$GITHUB_REPOSITORY" \
            --label emergency-change \
            --state all \
            --search "in:title \"Post-hoc review: $TAG\"" \
            --limit 1 \
            --json url \
            --jq '.[0].url // ""')"
          if [[ -n "$existing_issue" ]]; then
            echo "Post-hoc review issue already exists: $existing_issue" >> "$GITHUB_STEP_SUMMARY"
            exit 0
          fi

          gh label create emergency-change \
            --repo "$GITHUB_REPOSITORY" \
            --color D93F0B \
            --description "Expedited change requiring post-hoc review (SOC 2 evidence)" || true

          release_runs_url="$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/workflows/release-macos-aarch64.yml?query=branch%3A$TAG"
          tag_commit="$(git rev-list -n1 "$TAG")"

          body_file="$RUNNER_TEMP/post-hoc-review.md"
          cat > "$body_file" <<EOF
          This tag points at a commit that was not on \`dev\` when it was released
          (tag-first expedited path — versions live in tags, so no bump commit exists).

          - [ ] Reason / incident link:
          - [ ] Release App run: $release_runs_url
          - [ ] Triggering audit run: $TRIGGER_RUN_URL
          - [ ] Tagged commit ($tag_commit) landed on \`dev\` through a reviewed PR
          - [ ] Reviewed by someone other than the release actor

          Release actor: @$ACTOR

          Only the reviewer closes this issue, per [the emergency-change policy]($GITHUB_SERVER_URL/$GITHUB_REPOSITORY/blob/dev/docs/EMERGENCY-CHANGES.md).
          EOF

          issue_url="$(gh issue create \
            --repo "$GITHUB_REPOSITORY" \
            --title "Post-hoc review: $TAG (tag-first release)" \
            --label emergency-change \
            --body-file "$body_file")"
          gh issue edit "$issue_url" --add-assignee "$ACTOR" || true
          echo "Post-hoc review issue: $issue_url" >> "$GITHUB_STEP_SUMMARY"