name: Release image
# Triggered by `git tag image/vX.Y.Z-N && git push --tags`, independently of
# chart releases (release-chart.yaml) — see docs/versioning.md. N is a
# revision counter for rebuilds of the same aptly version (base-image CVE
# patches — see rebuild.yaml), not a new aptly release.
on:
  push:
    tags:
      - 'image/v*'

concurrency:
  group: release-image
  cancel-in-progress: false

jobs:
  release:
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Parse tag and assert it matches the Dockerfile
        id: version
        run: |
          set -euo pipefail
          tag="${GITEA_REF_NAME#image/v}"          # e.g. 1.6.3-1
          aptly_version="${tag%-*}"                 # 1.6.3
          revision="${tag##*-}"                     # 1
          minor="${aptly_version%.*}"                # 1.6
          from_dockerfile="$(grep -oP '(?<=^ARG APTLY_VERSION=)\S+' images/aptly-server/Dockerfile)"
          if [[ "$from_dockerfile" != "$aptly_version" ]]; then
            echo "::error::tag ${GITEA_REF_NAME} implies aptly ${aptly_version}, but images/aptly-server/Dockerfile has ARG APTLY_VERSION=${from_dockerfile}. Bump the Dockerfile and re-tag."
            exit 1
          fi
          {
            echo "full=${tag}"
            echo "aptly_version=${aptly_version}"
            echo "revision=${revision}"
            echo "minor=${minor}"
          } >> "$GITEA_OUTPUT"
        env:
          GITEA_REF_NAME: ${{ gitea.ref_name }}

      - name: Verify registry secrets are set
        run: |
          test -n "${{ secrets.REGISTRY_USER }}" || { echo "::error::REGISTRY_USER is not set"; exit 1; }
          test -n "${{ secrets.REGISTRY_TOKEN }}" || { echo "::error::REGISTRY_TOKEN is not set (needs write:package — GITEA_TOKEN cannot push packages on Gitea)"; exit 1; }

      - uses: docker/login-action@v3
        with:
          registry: git.morlana.online
          username: ${{ secrets.REGISTRY_USER }}
          password: ${{ secrets.REGISTRY_TOKEN }}

      - uses: docker/setup-qemu-action@v3
      - uses: docker/setup-buildx-action@v3
        with:
          driver-opts: |
            image=moby/buildkit:latest

      - name: Build & push aptly-server
        uses: docker/build-push-action@v6
        with:
          context: .
          file: images/aptly-server/Dockerfile
          platforms: linux/amd64,linux/arm64
          push: true
          provenance: false
          sbom: false
          build-args: |
            APTLY_VERSION=${{ steps.version.outputs.aptly_version }}
            APTLY_REVISION=${{ steps.version.outputs.revision }}
          tags: |
            git.morlana.online/f.weber/aptly:${{ steps.version.outputs.full }}
            git.morlana.online/f.weber/aptly:${{ steps.version.outputs.aptly_version }}
            git.morlana.online/f.weber/aptly:${{ steps.version.outputs.minor }}
            git.morlana.online/f.weber/aptly:latest

      - name: Build & push aptly-deb-builder
        uses: docker/build-push-action@v6
        with:
          context: .
          file: images/aptly-deb-builder/Dockerfile
          platforms: linux/amd64,linux/arm64
          push: true
          provenance: false
          sbom: false
          tags: |
            git.morlana.online/f.weber/aptly-deb-builder:${{ steps.version.outputs.full }}
            git.morlana.online/f.weber/aptly-deb-builder:${{ steps.version.outputs.aptly_version }}
            git.morlana.online/f.weber/aptly-deb-builder:latest

      - name: Create Gitea release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ gitea.ref_name }}
          name: "aptly image ${{ steps.version.outputs.full }}"
          body: |
            Images pushed:
            - `git.morlana.online/f.weber/aptly:${{ steps.version.outputs.full }}` (+ `${{ steps.version.outputs.aptly_version }}`, `${{ steps.version.outputs.minor }}`, `latest`)
            - `git.morlana.online/f.weber/aptly-deb-builder:${{ steps.version.outputs.full }}`

      - name: Bump chart appVersion (pins the last released image; never main-latest)
        run: |
          set -euo pipefail
          sed -i "s/^appVersion:.*/appVersion: \"${{ steps.version.outputs.full }}\"/" charts/aptly/Chart.yaml
          git config user.name "${{ gitea.actor }}"
          git config user.email "${{ gitea.actor }}@noreply.git.morlana.online"
          git add charts/aptly/Chart.yaml
          git diff --cached --quiet && exit 0
          git commit -m "chore: bump chart appVersion to ${{ steps.version.outputs.full }} [skip ci]"
          git push origin HEAD:main