name: Community Release

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: write
  packages: write

env:
  IMAGE_TAG: ${{ github.ref_name }}
  ADMIN_API_IMAGE: ghcr.io/${{ github.repository_owner }}/crank-community-admin-api
  MCP_SERVER_IMAGE: ghcr.io/${{ github.repository_owner }}/crank-community-mcp-server
  UI_IMAGE: ghcr.io/${{ github.repository_owner }}/crank-community-ui

jobs:
  build-release-assets:
    runs-on: [self-hosted, linux, x64]

    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: 1.85.0

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 22

      - name: Build release binaries
        run: cargo build --release -p admin-api -p mcp-server

      - name: Install UI dependencies
        working-directory: apps/ui
        run: npm ci

      - name: Build UI dist
        working-directory: apps/ui
        run: npm run build

      - name: Package release artifacts
        run: |
          mkdir -p dist/release
          cp target/release/admin-api dist/release/admin-api
          cp target/release/mcp-server dist/release/mcp-server
          tar -C dist/release -czf dist/crank-community-admin-api-${IMAGE_TAG}.tar.gz admin-api
          tar -C dist/release -czf dist/crank-community-mcp-server-${IMAGE_TAG}.tar.gz mcp-server
          tar -C apps/ui/dist -czf dist/crank-community-ui-${IMAGE_TAG}.tar.gz .
          sha256sum \
            dist/crank-community-admin-api-${IMAGE_TAG}.tar.gz \
            dist/crank-community-mcp-server-${IMAGE_TAG}.tar.gz \
            dist/crank-community-ui-${IMAGE_TAG}.tar.gz \
            > dist/crank-community-${IMAGE_TAG}-checksums.txt

      - name: Generate SBOM
        run: |
          docker run --rm -v "$PWD:/workspace" anchore/syft:latest \
            dir:/workspace -o spdx-json \
            > dist/crank-community-${IMAGE_TAG}-sbom.spdx.json

      - name: Upload release artifacts
        uses: actions/upload-artifact@v4
        with:
          name: community-release-artifacts
          path: |
            dist/crank-community-admin-api-${{ env.IMAGE_TAG }}.tar.gz
            dist/crank-community-mcp-server-${{ env.IMAGE_TAG }}.tar.gz
            dist/crank-community-ui-${{ env.IMAGE_TAG }}.tar.gz
            dist/crank-community-${{ env.IMAGE_TAG }}-checksums.txt
            dist/crank-community-${{ env.IMAGE_TAG }}-sbom.spdx.json

  publish-images:
    runs-on: [self-hosted, linux, x64]
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: admin-api
            dockerfile: apps/admin-api/Dockerfile
            image: ghcr.io/${{ github.repository_owner }}/crank-community-admin-api
          - name: mcp-server
            dockerfile: apps/mcp-server/Dockerfile
            image: ghcr.io/${{ github.repository_owner }}/crank-community-mcp-server
          - name: ui
            dockerfile: apps/ui/Dockerfile
            image: ghcr.io/${{ github.repository_owner }}/crank-community-ui

    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Log in to GHCR
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push ${{ matrix.name }}
        uses: docker/build-push-action@v7
        with:
          context: .
          file: ${{ matrix.dockerfile }}
          push: true
          tags: |
            ${{ matrix.image }}:${{ env.IMAGE_TAG }}
            ${{ matrix.image }}:latest

  github-release:
    needs:
      - build-release-assets
      - publish-images
    runs-on: [self-hosted, linux, x64]

    steps:
      - name: Download release artifacts
        uses: actions/download-artifact@v4
        with:
          name: community-release-artifacts
          path: dist

      - name: Publish GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          files: |
            dist/crank-community-admin-api-${{ env.IMAGE_TAG }}.tar.gz
            dist/crank-community-mcp-server-${{ env.IMAGE_TAG }}.tar.gz
            dist/crank-community-ui-${{ env.IMAGE_TAG }}.tar.gz
            dist/crank-community-${{ env.IMAGE_TAG }}-checksums.txt
            dist/crank-community-${{ env.IMAGE_TAG }}-sbom.spdx.json