name: Community Release

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:

env:
  REGISTRY: git.itexp.me
  IMAGE_TAG: ${{ gitea.ref_name }}
  ADMIN_API_IMAGE: git.itexp.me/bsodfather/crank-community-admin-api
  MCP_SERVER_IMAGE: git.itexp.me/bsodfather/crank-community-mcp-server
  UI_IMAGE: git.itexp.me/bsodfather/crank-community-ui
  OPENBAO_ENV_FILE: .openbao-env

jobs:
  release:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Verify runner toolchain
        run: |
          rustc --version
          cargo --version
          node --version
          npm --version
          docker --version
          command -v bao
          bao version

      - name: Build release binaries
        run: cargo build --release -p admin-api -p mcp-server

      - name: Install UI dependencies
        working-directory: apps/ui
        run: npm ci

      - name: Build UI dist
        working-directory: apps/ui
        run: npm run build

      - name: Package release artifacts
        run: |
          mkdir -p dist/release
          cp target/release/admin-api dist/release/admin-api
          cp target/release/mcp-server dist/release/mcp-server
          tar -C dist/release -czf dist/crank-community-admin-api-${IMAGE_TAG}.tar.gz admin-api
          tar -C dist/release -czf dist/crank-community-mcp-server-${IMAGE_TAG}.tar.gz mcp-server
          tar -C apps/ui/dist -czf dist/crank-community-ui-${IMAGE_TAG}.tar.gz .
          sha256sum \
            dist/crank-community-admin-api-${IMAGE_TAG}.tar.gz \
            dist/crank-community-mcp-server-${IMAGE_TAG}.tar.gz \
            dist/crank-community-ui-${IMAGE_TAG}.tar.gz \
            > dist/crank-community-${IMAGE_TAG}-checksums.txt

      - name: Generate SBOM
        run: |
          docker run --rm -v "$PWD:/workspace" anchore/syft:latest \
            dir:/workspace -o spdx-json \
            > dist/crank-community-${IMAGE_TAG}-sbom.spdx.json

      - name: Load deployment secrets from OpenBao
        env:
          BAO_ADDR: ${{ secrets.BAO_ADDR }}
          BAO_ROLE_ID: ${{ secrets.BAO_ROLE_ID }}
          BAO_SECRET_ID: ${{ secrets.BAO_SECRET_ID }}
          OPENBAO_APP: crank
        run: scripts/load-openbao-env.sh

      - name: Login to registry
        run: |
          . "$OPENBAO_ENV_FILE"
          printf '%s' "$DEPLOY_REGISTRY_TOKEN" | \
            docker login '${{ env.REGISTRY }}' -u "$DEPLOY_REGISTRY_USER" --password-stdin

      - name: Build and push release images
        run: |
          docker build -f apps/admin-api/Dockerfile \
            -t '${{ env.ADMIN_API_IMAGE }}:${{ env.IMAGE_TAG }}' \
            -t '${{ env.ADMIN_API_IMAGE }}:latest' .
          docker build -f apps/mcp-server/Dockerfile \
            -t '${{ env.MCP_SERVER_IMAGE }}:${{ env.IMAGE_TAG }}' \
            -t '${{ env.MCP_SERVER_IMAGE }}:latest' .
          docker build -f apps/ui/Dockerfile \
            -t '${{ env.UI_IMAGE }}:${{ env.IMAGE_TAG }}' \
            -t '${{ env.UI_IMAGE }}:latest' .
          docker push '${{ env.ADMIN_API_IMAGE }}:${{ env.IMAGE_TAG }}'
          docker push '${{ env.ADMIN_API_IMAGE }}:latest'
          docker push '${{ env.MCP_SERVER_IMAGE }}:${{ env.IMAGE_TAG }}'
          docker push '${{ env.MCP_SERVER_IMAGE }}:latest'
          docker push '${{ env.UI_IMAGE }}:${{ env.IMAGE_TAG }}'
          docker push '${{ env.UI_IMAGE }}:latest'

      - name: Show release bundle summary
        run: |
          ls -lh dist