name: Verify container release contracts

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

jobs:
  verify:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: "3.11"
      - run: python -m pip install "uv==0.11.14"
      - run: uv sync --extra dev --locked
      - run: uv run pytest -q
      - name: Honest scoped lint for release additions
        run: uv run ruff check --select F,I app/db/migrations.py scripts/image_release.py tests/release
      - name: Validate container contracts without registry writes
        run: uv run pytest -q tests/release
      - name: Build and smoke exact pull-request or main source image
        run: |
          uv run python -c 'from app.db.migrations import migration_inventory; print("\n".join(migration_inventory()))' > migration-inventory.txt
          printf '%s\n' 'PORTFOLIO_HUB_SECRET_CANARY_DO_NOT_SHIP' > .env.ci-canary
          RELEASE_VERSION="v$(python -c 'import tomllib; print(tomllib.load(open("pyproject.toml", "rb"))["project"]["version"])')"
          docker build --platform linux/amd64 --provenance=false \
            --build-arg "SOURCE_COMMIT=${GITHUB_SHA}" --build-arg "RELEASE_VERSION=${RELEASE_VERSION}" \
            --tag "portfolio-hub-ci:${GITHUB_SHA}" .
          uv run python scripts/image_release.py smoke --image "portfolio-hub-ci:${GITHUB_SHA}" --inventory migration-inventory.txt --timeout 180
          docker save --output portfolio-hub-image.tar "portfolio-hub-ci:${GITHUB_SHA}"
          uv run python scripts/image_release.py scan --image "portfolio-hub-ci:${GITHUB_SHA}" --archive portfolio-hub-image.tar