name: Publish Container Images

on:
  workflow_run:
    workflows:
      - Publish Supported Platform Target
    types:
      - completed
  workflow_dispatch:
    inputs:
      source_commit:
        description: Source commit to build
        required: true
        default: main
        type: string
      channel_commit:
        description: release-channel ref to search for the matching signed target
        required: false
        default: release-channel
        type: string

concurrency:
  group: production-container-images
  cancel-in-progress: false

env:
  DOCKERHUB_IMAGE: szcq/deepseek-harness
  GHCR_IMAGE: ghcr.io/${{ github.repository }}

jobs:
  build:
    name: Verify, test, and publish images
    if: >-
      (github.event_name == 'workflow_run' &&
       github.event.workflow_run.conclusion == 'success' &&
       github.event.workflow_run.head_branch == 'main') ||
      github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    timeout-minutes: 90
    environment: production-image
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout reviewed source
        uses: actions/checkout@v6
        with:
          ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || inputs.source_commit }}
          path: source

      - name: Checkout signed channel history
        uses: actions/checkout@v6
        with:
          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.channel_commit || 'release-channel' }}
          fetch-depth: 0
          path: channel

      - name: Resolve immutable signed channel state
        id: channel
        run: |
          source_commit="$(git -C source rev-parse HEAD)"
          channel_commit=
          while IFS= read -r candidate; do
            candidate_source="$(git -C channel show "${candidate}:channel.json" | jq -er .sourceCommit)"
            if test "$candidate_source" = "$source_commit"; then
              channel_commit="$candidate"
              break
            fi
          done < <(git -C channel log --format=%H -- channel.json)
          if test -z "$channel_commit"; then
            echo "No signed release-channel target matches source commit $source_commit" >&2
            exit 1
          fi
          git -C channel checkout --detach "$channel_commit"
          {
            printf 'commit=%s\n' "$channel_commit"
            printf 'source_commit=%s\n' "$source_commit"
          } >> "$GITHUB_OUTPUT"
          # shellcheck disable=SC2016
          printf 'Using signed channel commit `%s` for source commit `%s`.\n' \
            "$channel_commit" "$source_commit" >> "$GITHUB_STEP_SUMMARY"

      - name: Set up Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: npm
          cache-dependency-path: |
            source/container/control-plane/services/management/package-lock.json
            source/container/environment/resources/plugins/platform-management/package/package-lock.json

      - name: Install Management runtime dependencies
        working-directory: source
        run: |
          npm ci --omit=dev --ignore-scripts --no-audit --no-fund --prefix container/control-plane/services/management
          npm ci --omit=dev --ignore-scripts --no-audit --no-fund --legacy-peer-deps --prefix container/environment/resources/plugins/platform-management/package

      - name: Verify gateway and Compose configuration
        working-directory: source
        run: |
          npm test --prefix container/control-plane/services/gateway
          npm test --prefix container/platform
          node container/test/compose-config.mjs
          sh -n container/test/container-smoke.sh
          sh -n container/test/devtools-smoke.sh

      - name: Verify signed Supported Target
        id: signed-target
        working-directory: source
        env:
          RECOVERY_ROOT_PUBLIC_KEY: ${{ secrets.DSH_RECOVERY_ROOT_PUBLIC_KEY }}
        run: |
          test -n "$RECOVERY_ROOT_PUBLIC_KEY"
          source_commit="$(git rev-parse HEAD)"
          test "$(jq -er .sourceCommit ../channel/channel.json)" = "$source_commit"
          sequence="$(jq -er .targetSequence ../channel/stable.json)"
          test "$(jq -er .targetSequence ../channel/channel.json)" = "$sequence"
          release_dir="../channel/targets/$sequence"
          test -d "$release_dir"
          for name in stable.json stable.sig.json keyring.json keyring.sig.json; do
            cmp "../channel/$name" "$release_dir/$name"
          done
          image_input=container/platform/image-input
          mkdir -p "$image_input/release"
          cp -a "$release_dir/." "$image_input/release/"
          printf '%s\n' "$RECOVERY_ROOT_PUBLIC_KEY" > "$image_input/recovery-root.spki.base64"
          cp release/supported-target.json "$image_input/supported-target.json"
          cp container/environment/definition.json "$image_input/environment-definition.json"
          version="$(jq -er '.latestSupportedDsh' release/supported-target.json)"
          npm_input="$RUNNER_TEMP/image-npm-input"
          mkdir -p "$npm_input"
          npm pack "@deepseek-ai/dsh@${version}" --pack-destination "$npm_input" >/dev/null
          tarball="$(find "$npm_input" -maxdepth 1 -type f -name '*.tgz' -print -quit)"
          test -n "$tarball"
          cp "$tarball" "$image_input/dsh.tgz"
          verified="$(node container/platform/tools/verify-image-release.mjs \
            "$image_input/release" "$image_input/recovery-root.spki.base64" "$image_input/dsh.tgz" \
            "$image_input/supported-target.json" "$image_input/environment-definition.json")"
          test "$(jq -er .dshVersion <<<"$verified")" = "$version"
          test "$(jq -er .targetSequence <<<"$verified")" = "$sequence"
          environment_version="$(jq -er .environmentVersion <<<"$verified")"
          test "$environment_version" = "$(jq -er .version container/environment/definition.json)"
          {
            printf 'version=%s\n' "$version"
            printf 'environment_version=%s\n' "$environment_version"
            printf 'sequence=%s\n' "$sequence"
          } >> "$GITHUB_OUTPUT"
          cp "$image_input/recovery-root.spki.base64" container/platform/seed/trust/recovery-root.spki.base64
          cp "$release_dir/keyring.json" container/platform/seed/trust/keyring.json
          cp "$release_dir/keyring.sig.json" container/platform/seed/trust/keyring.sig.json
          rm container/platform/seed/trust/DEVELOPMENT_FIXTURE
          test ! -e container/platform/seed/trust/DEVELOPMENT_FIXTURE
          printf 'Building signed DSH %s with Environment %s (sequence %s).\n' \
            "$version" "$environment_version" "$sequence" >> "$GITHUB_STEP_SUMMARY"

      - name: Generate registry tags
        id: tags
        env:
          DSH_VERSION: ${{ steps.signed-target.outputs.version }}
          ENVIRONMENT_VERSION: ${{ steps.signed-target.outputs.environment_version }}
        run: |
          [[ "$ENVIRONMENT_VERSION" =~ ^([0-9]+)\.([0-9]+)\.([0-9]+)$ ]]
          major="${BASH_REMATCH[1]}"
          minor="${BASH_REMATCH[2]}"
          {
            echo 'standard<<EOF'
            echo "${DOCKERHUB_IMAGE}:${DSH_VERSION}"
            echo "${GHCR_IMAGE}:latest"
            echo "${GHCR_IMAGE}:${ENVIRONMENT_VERSION}"
            echo "${GHCR_IMAGE}:${major}.${minor}"
            echo "${GHCR_IMAGE}:${major}"
            echo "${GHCR_IMAGE}:dsh-${DSH_VERSION}"
            echo 'EOF'
            echo 'devtools<<EOF'
            echo "${DOCKERHUB_IMAGE}:${DSH_VERSION}-devtools"
            echo 'EOF'
          } >> "$GITHUB_OUTPUT"

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Build standard smoke-test image
        uses: docker/build-push-action@v7
        with:
          context: ./source
          file: ./source/Dockerfile
          platforms: linux/amd64
          load: true
          provenance: false
          build-args: |
            SIGNED_IMAGE_INPUT=true
            DSH_VERSION=${{ steps.signed-target.outputs.version }}
            ENVIRONMENT_VERSION=${{ steps.signed-target.outputs.environment_version }}
            TARGET_SEQUENCE=${{ steps.signed-target.outputs.sequence }}
            PLATFORM_REVISION=${{ steps.channel.outputs.source_commit }}
          tags: dsh-gateway-smoke:${{ github.run_id }}
          cache-from: type=gha,scope=standard
          cache-to: type=gha,mode=max,scope=standard

      - name: Run standard container smoke checks
        working-directory: source
        run: container/test/container-smoke.sh "dsh-gateway-smoke:${{ github.run_id }}"

      - name: Build devtools smoke-test image
        uses: docker/build-push-action@v7
        with:
          context: ./source
          file: ./source/Dockerfile
          platforms: linux/amd64
          load: true
          provenance: false
          build-args: |
            SIGNED_IMAGE_INPUT=true
            DSH_VERSION=${{ steps.signed-target.outputs.version }}
            ENVIRONMENT_VERSION=${{ steps.signed-target.outputs.environment_version }}
            TARGET_SEQUENCE=${{ steps.signed-target.outputs.sequence }}
            PLATFORM_REVISION=${{ steps.channel.outputs.source_commit }}
            INSTALL_DEVTOOLS=true
          tags: dsh-gateway-devtools-smoke:${{ github.run_id }}
          cache-from: type=gha,scope=devtools
          cache-to: type=gha,mode=max,scope=devtools

      - name: Run devtools smoke checks
        working-directory: source
        run: container/test/devtools-smoke.sh "dsh-gateway-devtools-smoke:${{ github.run_id }}"

      - name: Log in to Docker Hub
        uses: docker/login-action@v4
        with:
          username: szcq
          password: ${{ secrets.DOCKER_TOKEN }}

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ github.token }}

      - name: Push versioned devtools image to Docker Hub
        uses: docker/build-push-action@v7
        with:
          context: ./source
          file: ./source/Dockerfile
          platforms: linux/amd64,linux/arm64
          push: true
          provenance: false
          build-args: |
            SIGNED_IMAGE_INPUT=true
            DSH_VERSION=${{ steps.signed-target.outputs.version }}
            ENVIRONMENT_VERSION=${{ steps.signed-target.outputs.environment_version }}
            TARGET_SEQUENCE=${{ steps.signed-target.outputs.sequence }}
            PLATFORM_REVISION=${{ steps.channel.outputs.source_commit }}
            INSTALL_DEVTOOLS=true
          tags: ${{ steps.tags.outputs.devtools }}
          cache-from: type=gha,scope=devtools
          cache-to: type=gha,mode=max,scope=devtools

      - name: Push versioned standard image to Docker Hub and GHCR
        uses: docker/build-push-action@v7
        with:
          context: ./source
          file: ./source/Dockerfile
          platforms: linux/amd64,linux/arm64
          push: true
          provenance: false
          build-args: |
            SIGNED_IMAGE_INPUT=true
            DSH_VERSION=${{ steps.signed-target.outputs.version }}
            ENVIRONMENT_VERSION=${{ steps.signed-target.outputs.environment_version }}
            TARGET_SEQUENCE=${{ steps.signed-target.outputs.sequence }}
            PLATFORM_REVISION=${{ steps.channel.outputs.source_commit }}
          tags: ${{ steps.tags.outputs.standard }}
          cache-from: type=gha,scope=standard
          cache-to: type=gha,mode=max,scope=standard

      - name: Promote Docker Hub rolling tags
        env:
          DSH_VERSION: ${{ steps.signed-target.outputs.version }}
        run: |
          docker buildx imagetools create \
            --tag "${DOCKERHUB_IMAGE}:latest-devtools" \
            "${DOCKERHUB_IMAGE}:${DSH_VERSION}-devtools"
          docker buildx imagetools create \
            --tag "${DOCKERHUB_IMAGE}:latest" \
            "${DOCKERHUB_IMAGE}:${DSH_VERSION}"

      - name: Verify published registry manifests
        env:
          DSH_VERSION: ${{ steps.signed-target.outputs.version }}
          ENVIRONMENT_VERSION: ${{ steps.signed-target.outputs.environment_version }}
        run: |
          docker buildx imagetools inspect "${DOCKERHUB_IMAGE}:${DSH_VERSION}"
          docker buildx imagetools inspect "${DOCKERHUB_IMAGE}:${DSH_VERSION}-devtools"
          docker buildx imagetools inspect "${DOCKERHUB_IMAGE}:latest"
          docker buildx imagetools inspect "${DOCKERHUB_IMAGE}:latest-devtools"
          docker buildx imagetools inspect "${GHCR_IMAGE}:${ENVIRONMENT_VERSION}"
          docker buildx imagetools inspect "${GHCR_IMAGE}:dsh-${DSH_VERSION}"

    outputs:
      dsh_version: ${{ steps.signed-target.outputs.version }}
      environment_version: ${{ steps.signed-target.outputs.environment_version }}
      sequence: ${{ steps.signed-target.outputs.sequence }}

  notify-result:
    name: Notify container image publication result
    needs: build
    if: >-
      always() &&
      (needs.build.result == 'success' || needs.build.result == 'failure')
    uses: yjrszcq/github-workflows/.github/workflows/gotify-notify.yml@c4c7fe9e17854cd4962913ac2792513eab0be988
    with:
      title: >-
        ${{
          needs.build.result == 'success' &&
          format('DSH {0} 镜像已发布', needs.build.outputs.dsh_version) ||
          'DSH 镜像发布失败'
        }}
      message: >-
        ${{
          needs.build.result == 'success' &&
          format('DSH {0} 与 Environment {1} 的标准镜像已同步到 Docker Hub 和 GHCR，Devtools 镜像已发布到 Docker Hub；签名目标序列为 {2}。', needs.build.outputs.dsh_version, needs.build.outputs.environment_version, needs.build.outputs.sequence) ||
          format('Docker Hub 或 GHCR 镜像的构建、测试、推送或验证失败。请查看 GitHub Actions：{0}/{1}/actions/runs/{2}', github.server_url, github.repository, github.run_id)
        }}
      priority: ${{ needs.build.result == 'failure' && 8 || 7 }}
    secrets:
      gotify_url: ${{ secrets.GOTIFY_URL }}
      gotify_token: ${{ secrets.GOTIFY_TOKEN }}