name: Release
on:
  push:
    tags: ['v[0-9]+.[0-9]+.[0-9]+']

jobs:
  retag-image:
    runs-on: docker-host
    steps:
      - uses: actions/checkout@v7.0.1
      # Before anything is published: the contract version IS the release version, so a tag that
      # disagrees would ship a host misreporting itself to every plugin's compatibility check.
      - name: Refuse a tag that disagrees with HOST_API_VERSION
        env:
          GIT_TAG: ${{ github.ref_name }}
        run: |
          docker run --rm -v "$PWD:/repo" -w /repo node:24.19.0-alpine3.24 \
            node release-tooling/contract-version.ts "$GIT_TAG" src/plugin-host/plugin.ts
      - name: Promote the commit-hash image to semver + latest
        env:
          GIT_TAG: ${{ github.ref_name }}
          REGISTRY_TOKEN: ${{ secrets.DOCKER_REGISTRY_TOKEN }}
          REGISTRY_USER: ${{ vars.DOCKER_REGISTRY_USER }}
          REPO: gitea.larvit.se/${{ github.repository }}
        run: |
          COMMIT=$(git rev-parse 'HEAD^{commit}')
          VERSION=${GIT_TAG#v}
          printf '%s' "$REGISTRY_TOKEN" | docker login gitea.larvit.se -u "$REGISTRY_USER" --password-stdin
          docker pull "$REPO:$COMMIT" \
            || { echo "No image $REPO:$COMMIT - release tags must point at a commit whose branch passed the CI gate"; exit 1; }
          for TAG in "$VERSION" "${VERSION%.*}" "${VERSION%%.*}" latest; do
            docker tag "$REPO:$COMMIT" "$REPO:$TAG"
            docker push "$REPO:$TAG"
          done
      - name: Sync the release tags to Docker Hub
        env:
          DOCKERHUB_REPO: docker.io/${{ github.repository }}
          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
          DOCKERHUB_USER: ${{ vars.DOCKERHUB_USER }}
          GIT_TAG: ${{ github.ref_name }}
          REPO: gitea.larvit.se/${{ github.repository }}
        run: |
          COMMIT=$(git rev-parse 'HEAD^{commit}')
          VERSION=${GIT_TAG#v}
          [ -n "$DOCKERHUB_USER" ] && [ -n "$DOCKERHUB_TOKEN" ] \
            || { echo "Set the DOCKERHUB_USER variable + DOCKERHUB_TOKEN secret (README -> CI/CD)"; exit 1; }
          printf '%s' "$DOCKERHUB_TOKEN" | docker login docker.io -u "$DOCKERHUB_USER" --password-stdin
          for TAG in "$VERSION" "${VERSION%.*}" "${VERSION%%.*}" latest; do
            docker tag "$REPO:$COMMIT" "$DOCKERHUB_REPO:$TAG"
            docker push "$DOCKERHUB_REPO:$TAG"
          done
      - name: Publish the Docker Hub overview
        env:
          DOCKERHUB_REPO: ${{ github.repository }}
          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
          DOCKERHUB_USER: ${{ vars.DOCKERHUB_USER }}
          GIT_TAG: ${{ github.ref_name }}
        run: |
          docker run --rm -v "$PWD:/repo" -w /repo \
            -e DOCKERHUB_REPO -e DOCKERHUB_TOKEN -e DOCKERHUB_USER \
            node:24.19.0-alpine3.24 \
            node release-tooling/dockerhub-overview.ts "${GIT_TAG#v}"
      - name: Log out of the registries
        if: always()
        run: |
          docker logout gitea.larvit.se
          docker logout docker.io