---
name: publish images

on:
  push:
    branches: [main]
    paths:
      - '.gitea/workflows/publish-images.yml'
      - 'config/**'
      - 'container/**'
      - 'scripts/**'
      - 'src/**'
      - 'pyproject.toml'
      - 'README.md'
  workflow_dispatch:

jobs:
  publish-images:
    name: publish-images
    runs-on: self-hosted
    timeout-minutes: 45
    permissions:
      contents: read
    container:
      image: docker.io/gitea/runner-images:ubuntu-latest@sha256:fd911d7417bfbf0f454530e447da95b58001e1df41bbc5e1a8dd35d432575aae
      volumes:
        - /run/spire/agent-sockets:/run/spire/agent-sockets:ro
    env:
      PUSH_REGISTRY: zot-push.ad.ddupan.top
      PULL_REGISTRY: zot.ad.ddupan.top
      CONTROLLER_REPOSITORY: panxiao81/gitea-dynamic-runner-controller
      RUNNER_REPOSITORY: panxiao81/gitea-dynamic-runner-runner
      SPIRE_AGENT_SOCKET: /run/spire/agent-sockets/spire-agent.sock
    steps:
      - uses: actions/checkout@v4

      - name: Test source
        shell: bash
        run: |
          set -euo pipefail
          python3 -m pip install --break-system-packages -e '.[test]'
          pytest -q
          python3 -m compileall -q src tests
          apt-get update
          apt-get install --yes --no-install-recommends shellcheck
          shellcheck scripts/*

      - name: Fetch pinned SPIRE CLI
        shell: bash
        run: |
          set -euo pipefail
          archive=/tmp/spire.tar.gz
          curl --fail --location --silent --show-error \
            --output "$archive" \
            https://github.com/spiffe/spire/releases/download/v1.15.3/spire-1.15.3-linux-amd64-musl.tar.gz
          printf '%s  %s\n' \
            ca1a4d1155317bdd2afc7f36663828a10410c7c840e54725b90b4064b0a301c7 \
            "$archive" | sha256sum --check --status
          tar -xzf "$archive" -C /tmp spire-1.15.3/bin/spire-agent

      - name: Build and publish
        shell: bash
        run: |
          set -euo pipefail
          set +x

          : "${GITHUB_SHA:?GITHUB_SHA is required}"
          image_tag="sha-${GITHUB_SHA}"
          docker_config=$(mktemp -d)
          jwt_file=$(mktemp)
          cleanup() {
            docker buildx rm ci-builder >/dev/null 2>&1 || true
            rm -rf -- "$docker_config" "$jwt_file"
          }
          trap cleanup EXIT
          export DOCKER_CONFIG="$docker_config"

          /tmp/spire-1.15.3/bin/spire-agent api fetch jwt \
            -audience zot \
            -socketPath "$SPIRE_AGENT_SOCKET" \
            -output json >"$jwt_file"
          # shellcheck disable=SC2016
          jq -er '.[0].svids[0].svid' "$jwt_file" | \
            docker login "$PUSH_REGISTRY" --username zot --password-stdin

          docker buildx create \
            --name ci-builder \
            --driver docker-container \
            --use

          publish() {
            local repository=$1
            local dockerfile=$2
            local metadata=$3
            docker buildx build \
              --builder ci-builder \
              --platform linux/amd64 \
              --file "$dockerfile" \
              --tag "${PUSH_REGISTRY}/${repository}:${image_tag}" \
              --tag "${PUSH_REGISTRY}/${repository}:main" \
              --provenance=mode=max \
              --sbom=true \
              --metadata-file "$metadata" \
              --push \
              .
          }

          publish \
            "$CONTROLLER_REPOSITORY" \
            container/controller.Dockerfile \
            controller-metadata.json
          publish \
            "$RUNNER_REPOSITORY" \
            container/runner.Dockerfile \
            runner-metadata.json

          controller_digest=$(
            # shellcheck disable=SC2016
            jq -er '."containerimage.digest"' controller-metadata.json
          )
          runner_digest=$(
            # shellcheck disable=SC2016
            jq -er '."containerimage.digest"' runner-metadata.json
          )
          controller_ref="${PULL_REGISTRY}/${CONTROLLER_REPOSITORY}@${controller_digest}"
          runner_ref="${PULL_REGISTRY}/${RUNNER_REPOSITORY}@${runner_digest}"

          printf 'controller=%s\nrunner=%s\n' "$controller_ref" "$runner_ref"
          if [[ -n "${GITHUB_STEP_SUMMARY:-}" ]]; then
            {
              printf '## Published images\n\n'
              # shellcheck disable=SC2016
              printf -- '- Controller: `%s`\n' "$controller_ref"
              # shellcheck disable=SC2016
              printf -- '- Runner: `%s`\n' "$runner_ref"
              # shellcheck disable=SC2016
              printf -- '- Source: `%s`\n' "$GITHUB_SHA"
            } >>"$GITHUB_STEP_SUMMARY"
          fi