name: Release production image

# Releases are built, tested and pushed once by scripts/release-image.sh.
# Keep this opt-in workflow for explicit publisher use; tags do not trigger a second build.
on:
  workflow_dispatch:
    inputs:
      version:
        description: Existing immutable source tag (vX.Y.Z)
        required: true
        type: string

jobs:
  production-image:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ inputs.version }}
      - uses: docker/setup-qemu-action@v3
      - uses: docker/setup-buildx-action@v3
      - name: Log in to Gitea registry
        uses: docker/login-action@v3
        with:
          registry: gitea.skeletonworks.online
          username: ${{ secrets.REGISTRY_USERNAME }}
          password: ${{ secrets.REGISTRY_TOKEN }}
      - name: Resolve release metadata
        id: metadata
        shell: bash
        env:
          RELEASE_VERSION: ${{ inputs.version }}
        run: |
          version="$RELEASE_VERSION"
          [[ "$version" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]] || exit 1
          revision="$(git rev-parse HEAD)"
          short_revision="$(git rev-parse --short=12 HEAD)"
          created="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
          echo "version=${version}" >> "$GITHUB_OUTPUT"
          echo "revision=${revision}" >> "$GITHUB_OUTPUT"
          echo "short_revision=${short_revision}" >> "$GITHUB_OUTPUT"
          echo "created=${created}" >> "$GITHUB_OUTPUT"
      - name: Build and publish immutable images
        uses: docker/build-push-action@v6
        with:
          context: .
          file: Dockerfile.production
          platforms: linux/amd64
          push: true
          build-args: |
            VERSION=${{ steps.metadata.outputs.version }}
            REVISION=${{ steps.metadata.outputs.revision }}
            CREATED=${{ steps.metadata.outputs.created }}
          tags: |
            gitea.skeletonworks.online/vwiebe/conductor:${{ steps.metadata.outputs.version }}
            gitea.skeletonworks.online/vwiebe/conductor:git-${{ steps.metadata.outputs.short_revision }}
          provenance: mode=max
          sbom: true