name: Publish tagged container

on:
  push:
    tags: ["v*"]

permissions:
  contents: read
  checks: read
  actions: read
  packages: write
  id-token: write

jobs:
  validate-tag:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.tag.outputs.version }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - id: tag
        run: python scripts/release_version.py "$GITHUB_REF_NAME" >> "$GITHUB_OUTPUT"
      - name: Require tag version to match project metadata
        run: |
          project_version=$(python -c 'import tomllib; print(tomllib.load(open("pyproject.toml","rb"))["project"]["version"])')
          expected_version="${{ steps.tag.outputs.project_version }}"
          test "$project_version" = "$expected_version"
      - name: Require the tagged commit to be on main
        run: git merge-base --is-ancestor "$GITHUB_SHA" origin/main

  verify-required-checks:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Require successful quality and heavy validation for this commit
        uses: actions/github-script@v7
        with:
          script: |
            const required = [
              "python",
              "benchmark-helpers",
              "frontend (console)",
              "frontend (tui)",
              "rust",
              "image-light-smoke",
              "heavy-smoke-and-restore",
            ];
            const runs = await github.paginate(github.rest.checks.listForRef, {
              owner: context.repo.owner,
              repo: context.repo.repo,
              ref: context.sha,
              per_page: 100,
            });
            const failed = required.filter((name) =>
              !runs.some((run) => run.name === name && run.conclusion === "success")
            );
            if (failed.length) {
              core.setFailed(`Missing successful checks for ${context.sha}: ${failed.join(", ")}`);
            }
      - name: Download exact-commit validation artifacts
        uses: actions/github-script@v7
        with:
          script: |
            const fs = require("fs");
            const required = [
              ["quality.yaml", "light-production-validation", "light.zip"],
              ["heavy-validation.yaml", "heavy-production-validation", "heavy.zip"],
            ];
            for (const [workflow, artifactName, output] of required) {
              const response = await github.rest.actions.listWorkflowRuns({
                owner: context.repo.owner,
                repo: context.repo.repo,
                workflow_id: workflow,
                head_sha: context.sha,
                status: "completed",
                per_page: 100,
              });
              const run = response.data.workflow_runs.find(
                (item) => item.conclusion === "success"
              );
              if (!run) {
                core.setFailed(`No successful ${workflow} run found for ${context.sha}`);
                return;
              }
              const artifacts = await github.paginate(
                github.rest.actions.listWorkflowRunArtifacts,
                {
                  owner: context.repo.owner,
                  repo: context.repo.repo,
                  run_id: run.id,
                  per_page: 100,
                }
              );
              const artifact = artifacts.find(
                (item) => item.name === artifactName && !item.expired
              );
              if (!artifact) {
                core.setFailed(`Missing ${artifactName} on workflow run ${run.id}`);
                return;
              }
              const archive = await github.rest.actions.downloadArtifact({
                owner: context.repo.owner,
                repo: context.repo.repo,
                artifact_id: artifact.id,
                archive_format: "zip",
              });
              fs.writeFileSync(output, Buffer.from(archive.data));
            }
      - name: Enforce recorded product, restore, security, and benchmark gates
        run: |
          mkdir -p gate-input/light gate-input/heavy gate-artifacts
          unzip -q light.zip -d gate-input/light
          unzip -q heavy.zip -d gate-input/heavy
          python scripts/assemble_release_artifacts.py --light gate-input/light --heavy gate-input/heavy --output gate-artifacts
          python scripts/check_release_readiness.py gate-artifacts
      - uses: actions/upload-artifact@v4
        with:
          name: release-evidence-${{ github.ref_name }}
          path: gate-artifacts/

  publish:
    runs-on: ubuntu-latest
    needs: [validate-tag, verify-required-checks]
    steps:
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
        with:
          name: release-evidence-${{ github.ref_name }}
          path: gate-artifacts
      - name: Load and verify the gated image
        run: |
          gzip -dc gate-artifacts/brainapi-image.tar.gz | docker load
          expected=$(python -c 'import json; print(json.load(open("gate-artifacts/security.json"))["image_digest"])')
          actual=$(docker image inspect brainapi:ci --format '{{.Id}}')
          test "$actual" = "$expected"
      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - id: publish
        name: Publish the unchanged validated image
        run: |
          target="ghcr.io/lumen-labs/brainapi:$GITHUB_REF_NAME"
          docker tag brainapi:ci "$target"
          docker push "$target"
          digest=$(docker image inspect "$target" --format '{{index .RepoDigests 0}}' | cut -d@ -f2)
          test -n "$digest"
          echo "$digest" > image-digest.txt
      - uses: actions/upload-artifact@v4
        with:
          name: release-image-digest-${{ needs.validate-tag.outputs.version }}
          path: image-digest.txt