name: Publish verified PortfolioHub image

on:
  push:
    tags:
      - "v*.*.*"

permissions:
  contents: read

jobs:
  verify:
    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Reject every event except a strict version tag push
        env:
          RELEASE_EVENT: ${{ github.event_name }}
          RELEASE_REF: ${{ github.ref }}
          RELEASE_SHA: ${{ github.sha }}
        run: |
          python - <<'PY'
          import os, re
          assert os.environ["RELEASE_EVENT"] == "push"
          assert re.fullmatch(r"refs/tags/v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)", os.environ["RELEASE_REF"])
          assert re.fullmatch(r"[0-9a-f]{40}", os.environ["RELEASE_SHA"])
          PY
      - name: Check out exact tagged source commit
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          ref: ${{ github.sha }}
          fetch-depth: 0
      - run: python scripts/image_release.py validate-checkout --actual "$(git rev-parse HEAD)" --expected "${GITHUB_SHA}"
      - run: python scripts/image_release.py validate-event --event "${GITHUB_EVENT_NAME}" --ref "${GITHUB_REF}" --commit "${GITHUB_SHA}" --project pyproject.toml
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: "3.11"
      - run: python -m pip install "uv==0.11.14"
      - run: uv sync --extra dev --locked
      - run: uv run python -m pytest -q
      - name: Honest scoped lint
        run: uv run ruff check --select F,I app/db/migrations.py scripts/image_release.py scripts/ruff_ratchet.py tests/release
      - name: Reject Ruff findings introduced by v0.3.0 or later patches
        run: |
          uv run python scripts/ruff_ratchet.py --base v0.2.1
          uv run python scripts/ruff_ratchet.py --base v0.3.0
          uv run python scripts/ruff_ratchet.py --base v0.3.1
      - name: Record exact source migration inventory
        run: uv run python -c 'from app.db.migrations import migration_inventory; print("\n".join(migration_inventory()))' > migration-inventory.txt
      - name: Create excluded synthetic canary
        run: printf '%s\n' 'PORTFOLIO_HUB_SECRET_CANARY_DO_NOT_SHIP' > .env.ci-canary
      - name: Build exact source image once
        run: docker build --platform linux/amd64 --provenance=false --build-arg "SOURCE_COMMIT=${GITHUB_SHA}" --build-arg "RELEASE_VERSION=${GITHUB_REF_NAME}" --tag "portfolio-hub-ci:${GITHUB_SHA}" .
      - name: Smoke installed payload, health, migration and isolated PostgreSQL
        run: python scripts/image_release.py smoke --image "portfolio-hub-ci:${GITHUB_SHA}" --inventory migration-inventory.txt --timeout 180
      - name: Record tested image ID
        run: python scripts/image_release.py record-image-id --image "portfolio-hub-ci:${GITHUB_SHA}" --output portfolio-hub-image.id
      - name: Export tested image without rebuilding
        run: docker save --output portfolio-hub-image.tar "portfolio-hub-ci:${GITHUB_SHA}"
      - name: Scan filesystem, history, inspect, archive metadata and outputs
        run: |
          set +e
          python scripts/image_release.py scan --image "portfolio-hub-ci:${GITHUB_SHA}" --archive portfolio-hub-image.tar >canary-scan.stdout 2>canary-scan.stderr
          scan_status=$?
          set -e
          python scripts/image_release.py assert-clean-output canary-scan.stdout canary-scan.stderr
          exit "${scan_status}"
      - run: python scripts/image_release.py checksum --archive portfolio-hub-image.tar --output portfolio-hub-image.tar.sha256
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: tested-image-${{ github.run_id }}-${{ github.run_attempt }}
          if-no-files-found: error
          retention-days: 7
          path: |
            portfolio-hub-image.tar
            portfolio-hub-image.tar.sha256
            portfolio-hub-image.id
            migration-inventory.txt
            scripts/image_release.py

  publish:
    needs: verify
    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: tested-image-${{ github.run_id }}-${{ github.run_attempt }}
          path: tested-image
      - name: Load same archive, tag and publish without rebuilding
        id: publish
        env:
          GITHUB_ACTOR: ${{ github.actor }}
          REGISTRY_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          python tested-image/scripts/image_release.py publish \
            --archive tested-image/portfolio-hub-image.tar \
            --checksum tested-image/portfolio-hub-image.tar.sha256 \
            --image-id tested-image/portfolio-hub-image.id \
            --local-image "portfolio-hub-ci:${GITHUB_SHA}" \
            --commit "${GITHUB_SHA}" --event "${GITHUB_EVENT_NAME}" --ref "${GITHUB_REF}"