anodizer 0.28.0

use super::*;

/// Whether the tags at HEAD decide which crates this run releases.
///
/// A [tagless mode](is_tagless_mode) reads "no selected crates" as "every
/// crate", so HEAD's tags neither pick the crates nor end the run.
pub(crate) fn selection_depends_on_head_tags(opts: &ReleaseOpts) -> bool {
    opts.crate_names.is_empty() && !opts.all && !is_tagless_mode(opts)
}

/// Whether this run works without a tag at HEAD at all.
///
/// The ONE enumeration of those modes: `--snapshot` / `--nightly` /
/// `--dry-run` build without a real tag, `--publish-only` / `--announce-only`
/// consume a prior dist tree, and `--split` / `--merge` drive a multi-host
/// flow. Asked twice from one list, a mode added to one copy alone could
/// otherwise both need HEAD's tags and tolerate a repository git cannot read.
fn is_tagless_mode(opts: &ReleaseOpts) -> bool {
    opts.snapshot
        || opts.nightly
        || opts.dry_run
        || opts.publish_only
        || opts.announce_only
        || opts.split
        || opts.merge
}

/// Whether this run can proceed without reading the repository at all.
///
/// Deliberately NOT the negation of [`selection_depends_on_head_tags`]: that
/// predicate is also false for `--crate foo` and `--all`, which name the crates
/// themselves but still need a repository git will read — asking one question
/// for both let a real release continue past an unreadable repository.
fn mode_tolerates_an_unreadable_repository(opts: &ReleaseOpts) -> bool {
    is_tagless_mode(opts)
}

/// Decide what a failed crate selection means for this run.
///
/// A repository git refuses to read (dubious ownership, a checkout that is not
/// a work tree) used to read as "HEAD carries no release tags", so a release
/// that should have failed reported nothing to do and exited 0. It is now a
/// hard error wherever HEAD's tags pick the crates, and a warning that
/// continues with no selection in the modes that never consult them.
pub(crate) fn recover_crate_selection(
    selection: Result<Vec<String>>,
    opts: &ReleaseOpts,
    log: &StageLogger,
) -> Result<Vec<String>> {
    match selection {
        Ok(selected) => Ok(selected),
        Err(e)
            if mode_tolerates_an_unreadable_repository(opts)
                && e.chain().any(|c| c.is::<git::RepositoryUnreadable>()) =>
        {
            log.warn(&format!("continuing without the tags at HEAD: {e:#}"));
            Ok(Vec::new())
        }
        Err(e) => Err(e),
    }
}

/// Run `anodizer release`: build the configured pipeline for this mode and
/// execute every stage it selects.
pub(crate) fn run(mut opts: ReleaseOpts) -> Result<()> {
    if opts.prepare {
        apply_prepare_mode_to_skip(&mut opts.skip);
    }
    validate_strict_vs_allowlist(&opts)?;

    let log = StageLogger::new(
        "release",
        Verbosity::from_flags(opts.quiet, opts.verbose, opts.debug),
    );

    git::check_git_available()?;

    if opts.snapshot && opts.nightly {
        anyhow::bail!("--snapshot and --nightly cannot be combined");
    }

    let config_path =
        pipeline::find_config_with_logger(opts.config_override.as_deref(), Some(&log))?;
    // Load WITHOUT emitting advisories here: the submitter moderation-queue
    // advisories are deselection-aware and `Context` (which carries the
    // `--skip` / `--publishers` surface) does not exist yet. They are emitted
    // once below via `emit_config_advisories_filtered` after `ctx` is built,
    // so an advisory for a publisher the run deselected (e.g. chocolatey under
    // `--publishers npm`) is suppressed rather than printed as noise.
    let mut config = pipeline::load_config(&config_path)?;

    let workspace_skip = apply_workspace_overlay_for_opts(&mut config, &opts, &log)?;

    helpers::infer_project_name(&mut config, &log);
    helpers::auto_detect_github(&mut config, &log);

    apply_release_meta_overrides(&mut config, &opts)?;

    let all_known_crates: Vec<CrateConfig> = config.crate_universe().into_iter().cloned().collect();
    let selected_sorted = recover_crate_selection(
        resolve_selected_crates(&opts, &all_known_crates, &config, &log),
        &opts,
        &log,
    )?;

    // Tags-at-HEAD default path: when no --crate and no --all were given and
    // HEAD has no matching tags, this is a no-op (the push that triggered this
    // run didn't include any release tags).
    if selected_sorted.is_empty() && selection_depends_on_head_tags(&opts) {
        log.status("no release tags at HEAD — nothing to do");
        return Ok(());
    }

    // --host-targets: resolve the configured target union for the selected
    // crates down to the host-buildable subset, then feed it through the same
    // `targets` intersection-filter the Determinism Harness uses. Done here
    // (after crate selection, before the build context is assembled) so the
    // partition reflects the same per-crate build.targets / defaults.targets /
    // builds.ignore resolution every config mode shares.
    if opts.host_targets {
        resolve_host_targets(&mut opts, &config, &selected_sorted, &log)?;
    }

    let skip_stages = compute_skip_stages(opts.skip.clone(), &workspace_skip, opts.snapshot);

    let release_notes_path = read_release_notes_template(&opts)?;
    let simulate_failure_publishers = resolve_simulate_failure(&mut opts.simulate_failure)?;
    let runtime_nondeterministic_allowlist =
        parse_allow_nondeterministic(&opts.allow_nondeterministic)?;

    // Group the pre-pipeline setup (config-root resolution, env, git
    // context, `before:` hooks, snapshot/nightly notes, deprecation
    // warnings, milestone preflight) into one section so it renders as a
    // collapsible stage in CI rather than ungrouped flush-left output ahead
    // of the first `::group::`. Opened BEFORE `resolve_project_root` so its
    // bare-filename fallback warnings end up inside the section too. The scope
    // block drops the guard before the mode dispatch below, so each mode
    // opens its own sections cleanly.
    let project_root;
    let mut ctx;
    let setup_result;
    {
        let _setup = log.group("setup");
        // Retag to the section name so body lines inside `::group::setup`
        // render `[setup]` rather than the pipeline-level `[release]` tag.
        let log = log.with_stage("setup");

        project_root = resolve_project_root(&config_path, Some(&log));

        // Resolve the single-track aggregate changelog render set ONCE, via the
        // same shape predicate the standalone release-notes / json / kac formats
        // use, so the pipeline's GitHub release body spans the whole workspace
        // instead of the release crate's own path slice (the empty-notes
        // collapse). `None` for a per-crate workspace, where each crate's own
        // slice is the correct body. Covers both the full release and the
        // `--publish-only` re-run: both prepend ChangelogStage and dispatch from
        // this same context.
        let (render_set, single_track) = crate::commands::changelog::resolve_changelog_render_set(
            project_root
                .as_deref()
                .unwrap_or_else(|| std::path::Path::new(".")),
            &config,
        )?;
        let changelog_aggregate_set = single_track.then_some(render_set);

        let ctx_opts = build_context_options(
            &opts,
            skip_stages,
            selected_sorted,
            simulate_failure_publishers,
            runtime_nondeterministic_allowlist,
            project_root,
            changelog_aggregate_set,
        );
        ctx = Context::new(config.clone(), ctx_opts);
        // Install the pre-submitter verify-release gate once, at the single
        // production `Context::new` call site for the whole release
        // pipeline. `publish_only::run` / `run_per_crate` and the full
        // release path all dispatch from this same `ctx`, so installing
        // here covers every config mode (single-crate, lockstep, per-crate)
        // and both `release` / `release --publish-only` entry points for
        // free — no separate install call needed at either path. The
        // closure itself no-ops (`Ok(true)`) when `verify_release` is
        // disabled or out of scope, so this is unconditional rather than a
        // new config knob.
        install_verify_gate(&mut ctx);
        // Surface the submitter moderation-queue advisories now that `ctx`
        // carries the resolved `--skip` / `--publishers` selection surface,
        // skipping any whose publisher this run deselected (a `--publishers npm`
        // run must not print chocolatey/winget advisories). Verbose-only, once
        // per command — matching `load_config_logged`'s register/cardinality.
        pipeline::emit_config_advisories_filtered(&config, &log, |name| {
            ctx.publisher_deselected(name)
        });
        helpers::resolve_scm_token_type(&mut ctx, &config);
        ctx.populate_time_vars();
        ctx.populate_runtime_vars();
        ctx.populate_metadata_var()?;

        // Set explicitly in both branches so `{% if IsPrepare %}` evaluates
        // correctly either way (a missing var would short-circuit the
        // truthy arm even when prepare mode is requested).
        ctx.template_vars_mut().set_bool("IsPrepare", opts.prepare);

        // Dist-state enforcement (`--clean` removal / non-empty hard error)
        // emits its user-facing `would clean` note here so it sits inside
        // the setup section rather than ungrouped ahead of the run.
        //
        // Sequenced AFTER the tags-at-HEAD no-op short-circuit above on
        // purpose: a no-op run (push carried no release tags) must NOT wipe
        // a populated dist that a later --publish-only run will consume.
        // A real --clean release is never a no-op (it has selected crates,
        // or is --snapshot/--all/etc.), so it still falls through here and
        // cleans dist before the build stage in the pipeline below.
        enforce_dist_state(&config, &opts, &log)?;
        helpers::setup_env(&mut ctx, &config, &log)?;
        helpers::resolve_git_context(&mut ctx, &config, &log)?;

        // The version this run releases is fixed before anything asks about
        // it: a nightly or snapshot run rewrites `Version`/`Tag` (template
        // variables only), and the publisher probes below ask the registries
        // about the rewritten version.
        if ctx.is_nightly() {
            apply_nightly_template_vars(&mut ctx, &config, &log)?;
        }
        if ctx.is_snapshot() {
            apply_snapshot_template_vars(&mut ctx, &config, &log)?;
        }

        // The preflight runs BEFORE the `before:` hooks (which can take
        // minutes): a missing secret / tool / key, a pending one-way-door
        // submission or a diverged publish must abort with zero mutations
        // before any hook time is spent.
        if should_run_preflight(
            opts.snapshot,
            opts.dry_run,
            opts.split,
            ctx.should_skip("preflight"),
        ) {
            let scope = if opts.announce_only {
                crate::commands::preflight::PreflightScope::AnnounceOnly
            } else if opts.publish_only {
                crate::commands::preflight::PreflightScope::PublishOnly
            } else {
                crate::commands::preflight::PreflightScope::Full
            };
            let outcome = crate::commands::preflight::run_engine(&mut ctx, scope, &log)?;
            if !outcome.ok() {
                anyhow::bail!(outcome.failure_message());
            }
        }

        // The run enters the `before:`/`always:` bracket here: from this
        // call on, every exit — including a `before:` hook that failed —
        // leaves through the root `always:` hooks at the bottom of this
        // function. The gates ABOVE this line abort with zero mutations and
        // without having run a single operator command, so there is nothing
        // for a teardown hook to undo.
        setup_result =
            run_setup_inside_always_bracket(&mut ctx, &config, &opts, release_notes_path, &log);
    }

    // A pipeline failure leaves every tag, commit, and published artifact
    // exactly where it stopped: recovery is re-running this same command
    // (publishers reconcile and skip what is already published), and deliberate
    // withdrawal is `anodizer tag rollback`.
    //
    // `on_error:` stays scoped to a dispatched-mode failure — the boundary
    // past which the run can have mutated something. `always:` is wider by
    // design: it is the `finally` for everything inside the bracket,
    // including the zero-mutation gates below that `on_error:` deliberately
    // does not cover.
    let outcome = match setup_result {
        Err(err) => Err(err),
        Ok(()) => {
            let result = dispatch_release_modes(&mut ctx, &config, &opts, &log);
            if let Err(ref err) = result {
                on_error::fire_release_on_error(&ctx, err, &log);
            }
            result
        }
    };
    helpers::finish_with_always_hooks(&ctx, outcome, &log)
}

/// The setup steps that run inside the `always:` bracket: the root
/// `before:` hooks plus every gate sequenced after them.
///
/// Split out of [`run()`] so the bracket has one entry point — a step added
/// here is covered by the root `always:` hooks automatically, and one added
/// above the call site is deliberately outside them.
fn run_setup_inside_always_bracket(
    ctx: &mut Context,
    config: &Config,
    opts: &ReleaseOpts,
    release_notes_path: Option<(PathBuf, String)>,
    log: &StageLogger,
) -> Result<()> {
    run_before_hooks(ctx, config, opts, log)?;
    render_release_notes_tmpl(ctx, config, opts, release_notes_path, log)?;
    enforce_dirty_repo_gate(ctx)?;

    // In publish-only the preserved dist/config.yaml is already on disk and
    // its sha256 was recorded at determinism-check time; re-rendering it from
    // the current binary's config serialization would diverge from that hash
    // and trip hash_verify_preserved_dist. The --split BUILD leg uses
    // opts.split (it legitimately generates the dist) so it still writes here.
    if !opts.publish_only {
        helpers::write_effective_config(config, log)?;
    }

    if !opts.split
        && !opts.announce_only
        && let Some(ref milestones) = config.milestones
    {
        milestones::preflight_milestones(milestones, ctx, log)?;
    }

    Ok(())
}

/// Run the selected release mode (publish-only / announce-only / split /
/// merge / full pipeline). Split out of [`run()`] so the caller can route
/// every mode's failure through the root `on_error:` hooks uniformly,
/// while the zero-mutation preflight gates stay outside that boundary.
pub(crate) fn dispatch_release_modes(
    ctx: &mut Context,
    config: &Config,
    opts: &ReleaseOpts,
    log: &StageLogger,
) -> Result<()> {
    if opts.publish_only {
        // --publish-only consumes the preserved dist tree (artifacts.json /
        // context.json) rather than git tags-at-HEAD. Crate selection comes
        // from what the harness built (recorded in <dist>/context.json), not
        // from `selected_sorted`, so the tags-at-HEAD no-op guard above is
        // intentionally bypassed for this mode.
        let dist = config.dist.clone();
        let run_opts = publish_only::RunOpts {
            dry_run: opts.dry_run,
        };
        // When --crate is given, prefer the matching per-crate dist
        // subdir (`dist/<crate>/`) when one exists so the publish reads
        // that crate's preserved manifests, its per-crate `Tag`, and its
        // workspace overlay — same shape the no-flag auto-iteration uses.
        // Fall back to the flat root when no subdir exists (single-crate
        // preserve laid down at the dist root).
        if !opts.crate_names.is_empty() {
            let with_subdir: Vec<String> = opts
                .crate_names
                .iter()
                .filter(|name| publish_only::crate_subdir_has_manifest(&dist, name, log))
                .cloned()
                .collect();
            if with_subdir.is_empty() {
                return publish_only::run(ctx, config, log, run_opts);
            }
            // Fail closed on a partial match. When SOME requested crates
            // have a per-crate subdir and some don't, silently publishing
            // only the matched subset before an irreversible publish would
            // be a quiet scope reduction — the operator asked for crates
            // that aren't represented in the preserved dist. Name the
            // missing ones so they can fix the request or re-run preserve.
            if with_subdir.len() != opts.crate_names.len() {
                let missing: Vec<&String> = opts
                    .crate_names
                    .iter()
                    .filter(|name| !with_subdir.iter().any(|s| s == *name))
                    .collect();
                anyhow::bail!(
                    "publish-only --crate: {} of {} requested crate(s) have no \
                     preserved per-crate dist at {} (missing: {}). The remaining \
                     crates ({}) do. Refusing to silently publish only the subset \
                     before an irreversible publish — re-run with only the crates \
                     that were preserved, or re-run the preserve step so every \
                     requested crate has a dist/<crate>/ subdir.",
                    missing.len(),
                    opts.crate_names.len(),
                    dist.display(),
                    missing
                        .iter()
                        .map(|s| s.as_str())
                        .collect::<Vec<_>>()
                        .join(", "),
                    with_subdir.join(", "),
                );
            }
            let all_known: Vec<CrateConfig> =
                config.crate_universe().into_iter().cloned().collect();
            let sorted = topo_sort_selected(&all_known, &with_subdir);
            let order = if sorted.is_empty() {
                with_subdir
            } else {
                sorted
            };
            return publish_only::run_per_crate(ctx, config, log, run_opts, dist, order);
        }
        // Detect layout and dispatch.
        match publish_only::detect_dist_layout(&dist, log)? {
            publish_only::DistLayout::Flat => {
                return publish_only::run(ctx, config, log, run_opts);
            }
            publish_only::DistLayout::PerCrate(subdirs) => {
                // Topo-sort discovered crate names so depends_on ordering
                // is respected. Fall back to alphabetical when none of the
                // discovered names match any configured crate — but only
                // when NO workspace overlay was applied: post-overlay the
                // universe is one workspace's crates, and a zero-match dist
                // means every discovered subdir is a SIBLING crate that
                // would publish under this workspace's env/signs/skip. Fail
                // closed instead, mirroring the --crate partial-match bail
                // above.
                let all_known: Vec<CrateConfig> =
                    config.crate_universe().into_iter().cloned().collect();
                let sorted = topo_sort_selected(&all_known, &subdirs);
                if sorted.is_empty()
                    && let Some(ref ws_name) = opts.workspace
                {
                    let ws_crates: Vec<&str> = all_known.iter().map(|c| c.name.as_str()).collect();
                    anyhow::bail!(
                        "publish-only --workspace {}: none of the preserved per-crate dist \
                         subdirs at {} ({}) belong to workspace '{}' (its crates: {}). \
                         Refusing to publish sibling crates under this workspace's \
                         env/signs/skip — check the workspace name, or point the run at \
                         the preserved dist produced for this workspace.",
                        ws_name,
                        dist.display(),
                        subdirs.join(", "),
                        ws_name,
                        if ws_crates.is_empty() {
                            "(none)".to_string()
                        } else {
                            ws_crates.join(", ")
                        },
                    );
                }
                let order = if sorted.is_empty() { subdirs } else { sorted };
                return publish_only::run_per_crate(ctx, config, log, run_opts, dist, order);
            }
            publish_only::DistLayout::Ambiguous { crate_subdirs } => {
                anyhow::bail!(
                    "publish-only: ambiguous dist layout at {} — found both a flat \
                     context.json at the root AND per-crate subdirectories ({}). \
                     Delete one or the other, or pass --crate <name> to select a \
                     specific crate.",
                    dist.display(),
                    crate_subdirs.join(", ")
                );
            }
        }
    }

    if opts.announce_only {
        return announce_only::run(ctx, config, log, opts.dry_run);
    }

    if opts.split {
        return split::run_split(ctx, config, log);
    }

    if opts.merge {
        return split::run_merge(ctx, config, log, opts.dry_run, None);
    }

    let p = pipeline::build_release_pipeline();
    let result = p.run(ctx, log);

    if result.is_ok() {
        run_post_pipeline(ctx, config, opts.dry_run, RootAfterHooks::Fire, log)?;
    }

    if result.is_ok() {
        gate_required_failures(ctx)?;
    }

    result
}