name: release

# On a version tag (e.g. v0.1.0): publish versioned container images to GHCR
# and build the Python package. Manual dispatch is allowed for ad-hoc rebuilds.
#
# NOTE: publishing the Python package to PyPI is intentionally NOT configured
# here — that's an external deployment that should be a deliberate manual step
# (see docs/release/release-checklist.md). This workflow only builds the
# package and attaches it to the GitHub Release as an artifact.
on:
  push:
    tags: ["v*"]
  workflow_dispatch:

permissions:
  contents: write   # create GitHub Releases + attach assets
  packages: write   # required to push to ghcr.io

env:
  REGISTRY: ghcr.io

jobs:
  python-package:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.11"
      - name: Build sdist + wheel
        run: |
          python -m pip install --upgrade build twine
          python -m build
          twine check dist/*
      - name: Upload package artifacts
        uses: actions/upload-artifact@v4
        with:
          name: python-package
          path: dist/*
      - name: Attach package to the GitHub Release
        if: startsWith(github.ref, 'refs/tags/v')
        uses: softprops/action-gh-release@v2
        with:
          files: dist/*
          generate_release_notes: true

  images:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        include:
          - name: auralynq-api
            dockerfile: containers/api.Dockerfile
            context: .
          - name: auralynq-web
            dockerfile: containers/web.Dockerfile
            context: web
          - name: auralynq-caddy
            dockerfile: containers/caddy.Dockerfile
            context: .
    steps:
      - uses: actions/checkout@v4

      - name: Derive version + namespace
        id: meta
        run: |
          # Version from the tag (v0.1.0 -> 0.1.0) or the package on manual dispatch.
          if [[ "${GITHUB_REF}" == refs/tags/v* ]]; then
            VERSION="${GITHUB_REF#refs/tags/v}"
          else
            VERSION="$(python3 -c 'import re,sys;print(re.search(r"version\s*=\s*\"([^\"]+)\"",open("pyproject.toml").read()).group(1))')"
          fi
          MINOR="$(echo "$VERSION" | awk -F. '{print $1"."$2}')"
          NS="$(echo "${GITHUB_REPOSITORY_OWNER}" | tr '[:upper:]' '[:lower:]')"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "minor=$MINOR"     >> "$GITHUB_OUTPUT"
          echo "ns=$NS"           >> "$GITHUB_OUTPUT"
          echo "sha=${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT"

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build and push ${{ matrix.name }}
        uses: docker/build-push-action@v6
        with:
          context: ${{ matrix.context }}
          file: ${{ matrix.dockerfile }}
          push: true
          provenance: false
          build-args: |
            NEXT_PUBLIC_API_BASE=/api
            AURALYNQ_CERT_HOST=localhost
          tags: |
            ${{ env.REGISTRY }}/${{ steps.meta.outputs.ns }}/${{ matrix.name }}:${{ steps.meta.outputs.version }}
            ${{ env.REGISTRY }}/${{ steps.meta.outputs.ns }}/${{ matrix.name }}:${{ steps.meta.outputs.minor }}
            ${{ env.REGISTRY }}/${{ steps.meta.outputs.ns }}/${{ matrix.name }}:${{ steps.meta.outputs.sha }}
            ${{ env.REGISTRY }}/${{ steps.meta.outputs.ns }}/${{ matrix.name }}:latest
          labels: |
            org.opencontainers.image.title=${{ matrix.name }}
            org.opencontainers.image.version=${{ steps.meta.outputs.version }}
            org.opencontainers.image.revision=${{ github.sha }}
            org.opencontainers.image.source=https://github.com/${{ github.repository }}
            org.opencontainers.image.licenses=Apache-2.0