name: Publish verified container image

on:
  push:
    branches:
      - main
    tags:
      - "v*"

permissions:
  contents: read

jobs:
  verify:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Check out exact source commit
        uses: actions/checkout@v4
        with:
          ref: ${{ github.sha }}
          fetch-depth: 0

      - name: Set up Python 3.12
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"
          cache: pip

      - name: Install repository checks
        run: |
          python -m pip install "uv==0.11.14"
          uv sync --extra dev --locked

      - name: Run repository lint
        run: uv run ruff check .

      - name: Run repository tests
        run: uv run pytest

      - name: Create excluded synthetic canary
        run: |
          python - <<'PY'
          from pathlib import Path
          Path(".env.ci-canary").write_text("TREX_SECRET_CANARY_DO_NOT_SHIP\n", encoding="ascii")
          PY

      - name: Build source image once
        run: |
          docker build \
            --provenance=false \
            --build-arg "SOURCE_COMMIT=${GITHUB_SHA}" \
            --tag "trex-core-ci:${GITHUB_SHA}" \
            .

      - name: Smoke built image
        run: python scripts/image_release.py smoke --image "trex-core-ci:${GITHUB_SHA}"

      - name: Record tested image ID
        run: |
          python scripts/image_release.py record-image-id \
            --image "trex-core-ci:${GITHUB_SHA}" \
            --output trex-core-image.id

      - name: Export tested image
        run: docker save --output trex-core-image.tar "trex-core-ci:${GITHUB_SHA}"

      - name: Scan all canary surfaces
        run: |
          set +e
          python scripts/image_release.py scan \
            --image "trex-core-ci:${GITHUB_SHA}" \
            --archive trex-core-image.tar \
            >canary-scan.stdout 2>canary-scan.stderr
          scan_status=$?
          set -e
          python scripts/image_release.py assert-clean-output \
            canary-scan.stdout canary-scan.stderr
          exit "${scan_status}"

      - name: Record tested archive checksum
        run: |
          python scripts/image_release.py checksum \
            --archive trex-core-image.tar \
            --output trex-core-image.tar.sha256

      - name: Upload immutable tested image artifact
        uses: actions/upload-artifact@v4
        with:
          name: tested-image-${{ github.run_id }}-${{ github.run_attempt }}
          if-no-files-found: error
          overwrite: false
          retention-days: 7
          path: |
            trex-core-image.tar
            trex-core-image.tar.sha256
            trex-core-image.id
            scripts/image_release.py

  publish:
    needs: verify
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    outputs:
      image: ${{ steps.publish.outputs.image }}
      digest: ${{ steps.publish.outputs.digest }}
      source_commit: ${{ steps.publish.outputs.source_commit }}
    steps:
      - name: Download tested image artifact
        uses: actions/download-artifact@v4
        with:
          name: tested-image-${{ github.run_id }}-${{ github.run_attempt }}
          path: tested-image

      - name: Verify, load, and publish without rebuilding
        id: publish
        env:
          GITHUB_ACTOR: ${{ github.actor }}
          REGISTRY_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          python tested-image/scripts/image_release.py publish \
            --archive tested-image/trex-core-image.tar \
            --checksum tested-image/trex-core-image.tar.sha256 \
            --image-id tested-image/trex-core-image.id \
            --local-image "trex-core-ci:${GITHUB_SHA}" \
            --commit "${GITHUB_SHA}" \
            --ref "${GITHUB_REF}"