# Release: on a v* tag, give the already tested :sha-<sha> image the version tag.
# Nothing is rebuilt, so production runs the exact image CI tested. Never tags :latest.
# ci.yml pushes :sha-<sha> for the same tag push. This job waits for it.
name: release

on:
  push:
    tags: ["v*"]

env:
  REGISTRY: gt.pescoinc.biz
  IMAGE_NAME: gt.pescoinc.biz/spencerm/packetstation

jobs:
  retag:
    runs-on: ubuntu-latest
    steps:
      - uses: docker/setup-buildx-action@v3

      - uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ secrets.REGISTRY_USER }}
          password: ${{ secrets.REGISTRY_TOKEN }}

      - name: Check the tag name
        env:
          TAG: ${{ gitea.ref_name }}
        run: |
          set -euo pipefail
          if ! printf '%s' "$TAG" | grep -Eq '^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.]+)?$'; then
            echo "Tag $TAG is not vX.Y.Z" >&2
            exit 1
          fi

      - name: Wait for the tested sha image
        env:
          SRC: ${{ env.IMAGE_NAME }}:sha-${{ gitea.sha }}
        run: |
          set -euo pipefail
          # ci.yml builds it only after the server and frontend jobs pass. Wait up to 60 minutes.
          for i in $(seq 1 120); do
            if docker buildx imagetools inspect "$SRC" > /dev/null 2>&1; then
              echo "Found $SRC"
              exit 0
            fi
            sleep 30
          done
          echo "$SRC never appeared. Did CI fail for this commit?" >&2
          exit 1

      - name: Re-tag as the version
        env:
          SRC: ${{ env.IMAGE_NAME }}:sha-${{ gitea.sha }}
          DST: ${{ env.IMAGE_NAME }}:${{ gitea.ref_name }}
        run: |
          set -euo pipefail
          docker buildx imagetools create --tag "$DST" "$SRC"
          docker buildx imagetools inspect "$DST"