---
name: publish images

on:
  push:
    branches: [main]
    paths:
      - '.gitea/workflows/publish-images.yml'
      - 'config/**'
      - 'container/**'
      - 'scripts/**'
      - 'src/**'
      - 'pyproject.toml'
      - 'README.md'
  workflow_dispatch:

jobs:
  publish-images:
    name: publish-images
    runs-on: [self-hosted, pod]
    timeout-minutes: 45
    permissions:
      contents: read
    env:
      PUSH_REGISTRY: zot-push.ad.ddupan.top
      PULL_REGISTRY: zot.ad.ddupan.top
      CONTROLLER_REPOSITORY: panxiao81/gitea-dynamic-runner-controller
      RUNNER_REPOSITORY: panxiao81/gitea-dynamic-runner-runner
      SPIRE_AGENT_SOCKET: /run/spire/agent-sockets/spire-agent.sock
    steps:
      - uses: actions/checkout@v4

      - name: Test source
        shell: bash
        run: |
          set -euo pipefail
          python3 -m pip install --break-system-packages -e '.[test]'
          pytest -q
          python3 -m compileall -q src tests
          apt-get update
          apt-get install --yes --no-install-recommends shellcheck
          shellcheck scripts/*

      - name: Start Docker
        shell: bash
        run: |
          set -euo pipefail
          dockerd >/tmp/dockerd.log 2>&1 &
          for _ in $(seq 1 60); do
            if docker info >/dev/null 2>&1; then
              exit 0
            fi
            if ! kill -0 "$!" 2>/dev/null; then
              cat /tmp/dockerd.log >&2
              exit 1
            fi
            sleep 1
          done
          cat /tmp/dockerd.log >&2
          exit 1

      - name: Build and publish
        shell: bash
        run: |
          set -euo pipefail
          set +x

          : "${GITHUB_SHA:?GITHUB_SHA is required}"
          image_tag="sha-${GITHUB_SHA}"
          docker_config=$(mktemp -d)
          jwt_file=$(mktemp)
          cleanup() {
            rm -rf -- "$docker_config" "$jwt_file"
            docker buildx rm ci-builder >/dev/null 2>&1 || true
          }
          trap cleanup EXIT
          export DOCKER_CONFIG="$docker_config"

          /opt/spire/bin/spire-agent api fetch jwt \
            -audience zot \
            -socketPath "$SPIRE_AGENT_SOCKET" \
            -output json >"$jwt_file"
          # shellcheck disable=SC2016
          jq -er '.[0].svids[0].svid' "$jwt_file" | \
            docker login "$PUSH_REGISTRY" --username zot --password-stdin

          docker buildx create --name ci-builder --driver docker-container --use

          publish() {
            local repository=$1
            local dockerfile=$2
            local metadata=$3
            docker buildx build \
              --builder ci-builder \
              --platform linux/amd64 \
              --file "$dockerfile" \
              --tag "${PUSH_REGISTRY}/${repository}:${image_tag}" \
              --tag "${PUSH_REGISTRY}/${repository}:main" \
              --provenance=mode=max \
              --sbom=true \
              --metadata-file "$metadata" \
              --push \
              .
          }

          publish \
            "$CONTROLLER_REPOSITORY" \
            container/controller.Dockerfile \
            controller-metadata.json
          publish \
            "$RUNNER_REPOSITORY" \
            container/runner.Dockerfile \
            runner-metadata.json

          controller_digest=$(
            # shellcheck disable=SC2016
            jq -er '."containerimage.digest"' controller-metadata.json
          )
          runner_digest=$(
            # shellcheck disable=SC2016
            jq -er '."containerimage.digest"' runner-metadata.json
          )
          controller_ref="${PULL_REGISTRY}/${CONTROLLER_REPOSITORY}@${controller_digest}"
          runner_ref="${PULL_REGISTRY}/${RUNNER_REPOSITORY}@${runner_digest}"

          printf 'controller=%s\nrunner=%s\n' "$controller_ref" "$runner_ref"
          if [[ -n "${GITHUB_STEP_SUMMARY:-}" ]]; then
            {
              printf '## Published images\n\n'
              # shellcheck disable=SC2016
              printf -- '- Controller: `%s`\n' "$controller_ref"
              # shellcheck disable=SC2016
              printf -- '- Runner: `%s`\n' "$runner_ref"
              # shellcheck disable=SC2016
              printf -- '- Source: `%s`\n' "$GITHUB_SHA"
            } >>"$GITHUB_STEP_SUMMARY"
          fi