name: "Deploy via package-updater"
description: "Notifies one or more package-updater instances to pull & restart a service"
inputs:
  endpoint:
    description: "Full URL to /update. Give several, one per line, to update a fleet."
    required: true
  image:
    description: "Image reference without tag (e.g. registry.example.com/myapp)"
    required: true
  tag:
    description: "Tag that was just pushed (for logging)"
    required: false
    default: ""
  token:
    description: "Bearer token for package-updater"
    required: true
runs:
  using: "composite"
  steps:
    - name: Trigger update
      shell: bash
      env:
        ENDPOINTS: ${{ inputs.endpoint }}
        IMAGE: ${{ inputs.image }}
        TAG: ${{ inputs.tag }}
        TOKEN: ${{ inputs.token }}
      run: |
        # No `set -e`: a failing endpoint must not abort the loop, or one dead
        # server leaves the rest of the fleet un-updated and hides which hosts
        # actually succeeded.
        set -uo pipefail

        payload=$(jq -nc --arg image "$IMAGE" --arg tag "$TAG" \
          '{image: $image, tag: $tag}')

        attempted=0
        failed=0

        while IFS= read -r endpoint; do
          # URLs never contain whitespace, so stripping all of it safely
          # handles indentation, blank lines and CRLF line endings.
          endpoint=$(printf '%s' "$endpoint" | tr -d '[:space:]')
          [ -z "$endpoint" ] && continue

          attempted=$((attempted + 1))
          echo "--- $endpoint"

          if ! response=$(curl -sS -w "\n%{http_code}" \
            -X POST "$endpoint" \
            -H "Authorization: Bearer $TOKEN" \
            -H "Content-Type: application/json" \
            -d "$payload"); then
            echo "unreachable"
            failed=$((failed + 1))
            continue
          fi

          # Split on the last newline: curl's -w appended the status code
          # there. Pure bash — `head -n -1` is GNU-only and fails on
          # BSD/macOS, so the fan-out could not be tested locally.
          code="${response##*$'\n'}"
          body="${response%$'\n'*}"
          echo "HTTP $code"
          printf '%s' "$body" | jq . || printf '%s\n' "$body"

          if [ "$code" -ge 400 ]; then
            failed=$((failed + 1))
          fi
        done <<< "$ENDPOINTS"

        if [ "$attempted" -eq 0 ]; then
          echo "no endpoints given"
          exit 1
        fi
        if [ "$failed" -gt 0 ]; then
          echo "$failed of $attempted endpoint(s) failed"
          exit 1
        fi
        echo "all $attempted endpoint(s) updated"