name: Publish container images

on:
  push:
    branches:
      - main
    tags:
      - "v*"
  workflow_dispatch:

permissions:
  contents: write
  packages: write

jobs:
  publish:
    name: Publish ${{ matrix.image }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - image: open-ai-canvas-web
            dockerfile: Dockerfile
          - image: open-ai-canvas-backend
            dockerfile: backend/Dockerfile

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Resolve and validate build version
        id: build-info
        shell: bash
        run: |
          version="$(tr -d '\r\n' < VERSION)"
          if [[ "$GITHUB_REF" == refs/tags/v* ]]; then
            [[ "$version" == "$GITHUB_REF_NAME" ]] || { echo "VERSION=$version does not match tag $GITHUB_REF_NAME" >&2; exit 1; }
            grep -Fqx "## $version" CHANGELOG.md || { echo "CHANGELOG.md is missing ## $version" >&2; exit 1; }
          fi
          echo "version=$version" >> "$GITHUB_OUTPUT"
          echo "image_tag=${version#v}" >> "$GITHUB_OUTPUT"
          if [[ "$version" =~ ^v[0-9]+\.[0-9]+\.[0-9]+([+-][0-9A-Za-z.-]+)?$ ]]; then
            echo "is_semver=true" >> "$GITHUB_OUTPUT"
          else
            echo "is_semver=false" >> "$GITHUB_OUTPUT"
          fi
          echo "build_time=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Generate image metadata
        id: metadata
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/${{ github.repository_owner }}/${{ matrix.image }}
          tags: |
            type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
            type=raw,value=${{ steps.build-info.outputs.image_tag }},enable=${{ startsWith(github.ref, 'refs/tags/v') }}
            type=semver,pattern={{version}},enable=${{ steps.build-info.outputs.is_semver == 'true' }}
            type=sha,prefix=sha-

      - name: Build and push image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ${{ matrix.dockerfile }}
          platforms: linux/amd64,linux/arm64
          push: true
          build-args: |
            BUILD_VERSION=${{ steps.build-info.outputs.version }}
            BUILD_COMMIT=${{ github.sha }}
            BUILD_TIME=${{ steps.build-info.outputs.build_time }}
          tags: ${{ steps.metadata.outputs.tags }}
          labels: ${{ steps.metadata.outputs.labels }}
          cache-from: type=gha,scope=${{ matrix.image }}
          cache-to: type=gha,mode=max,scope=${{ matrix.image }}

  release:
    name: Publish release assets
    if: startsWith(github.ref, 'refs/tags/v')
    needs: publish
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version-file: backend/go.mod
          cache-dependency-path: backend/go.sum

      - name: Build Host Updater
        working-directory: backend
        shell: bash
        run: |
          mkdir -p ../dist
          for arch in amd64 arm64; do
            CGO_ENABLED=0 GOOS=linux GOARCH="$arch" go build -trimpath -ldflags="-s -w" -o "../dist/open-ai-canvas-host-updater-linux-$arch" ./cmd/host-updater
          done
          cd ../dist
          sha256sum open-ai-canvas-host-updater-linux-* > SHA256SUMS

      - name: Prepare release notes
        shell: bash
        run: |
          version="$GITHUB_REF_NAME"
          awk -v heading="## $version" '
            $0 == heading { found=1; next }
            found && /^## / { exit }
            found { print }
          ' CHANGELOG.md > dist/RELEASE_NOTES.md
          test -s dist/RELEASE_NOTES.md || printf '影策 %s\n' "$version" > dist/RELEASE_NOTES.md

      - name: Create GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
        shell: bash
        run: |
          prerelease_args=()
          if [[ "$GITHUB_REF_NAME" == *-* ]]; then
            prerelease_args+=(--prerelease)
          fi
          gh release create "$GITHUB_REF_NAME" \
            dist/open-ai-canvas-host-updater-linux-amd64 \
            dist/open-ai-canvas-host-updater-linux-arm64 \
            dist/SHA256SUMS \
            docker-compose.deploy.yml \
            --verify-tag \
            --title "$GITHUB_REF_NAME" \
            --notes-file dist/RELEASE_NOTES.md \
            "${prerelease_args[@]}"