name: Release Images

# Baut die Container-Images und haengt sie als .tar.gz an den Release.
# Pro Asset: docker save | gzip -> Gitea-Release-Asset (Download = HTTPS-GET,
# auf der Zielmaschine `docker load < <datei>.tar.gz`).
#
# Multi-Arch via buildx + QEMU:
#   - dtrack-stdio  amd64        (Arbeits-Notebook)
#   - dtrack-http   amd64        ("nicht Mac" / Intel)
#   - dtrack-http   arm64        (Apple Silicon Mac)
#
# Auth ueber das automatische Actions-Token (gitea.token) -- kein Secret noetig.
# Hinweis: braucht das buildx-Plugin und privilegiertes QEMU-binfmt fuer arm64.
# nodejs ist noetig, weil actions/checkout eine Node-Action ist.

on:
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      tag:
        description: "Release-Tag (z.B. v0.1.0) -- der Release muss bereits existieren"
        required: true

jobs:
  build-and-attach:
    runs-on: host

    steps:
      - name: Install deps
        run: apk add --no-cache curl jq git nodejs docker-cli docker-cli-buildx

      - name: Checkout
        uses: actions/checkout@v4

      - name: Resolve tag
        id: vars
        run: |
          if [ "${{ gitea.event_name }}" = "release" ]; then
            echo "tag=${{ gitea.ref_name }}" >> $GITHUB_OUTPUT
          else
            echo "tag=${{ inputs.tag }}" >> $GITHUB_OUTPUT
          fi

      - name: Setup QEMU (arm64-Cross-Build)
        run: docker run --privileged --rm tonistiigi/binfmt --install arm64

      - name: Setup buildx
        run: |
          docker buildx create --name dtrackbuilder --use 2>/dev/null || docker buildx use dtrackbuilder
          docker buildx inspect --bootstrap

      - name: Build, save & attach
        env:
          # Automatisches, schreibberechtigtes Token des Laufs.
          TOKEN: ${{ gitea.token }}
        run: |
          set -eu
          TAG="${{ steps.vars.outputs.tag }}"
          REPO="${{ gitea.repository }}"
          API="https://git.sithies.de/api/v1/repos/${REPO}/releases"
          AUTH="Authorization: token ${TOKEN}"

          # Release-Lookup mit Diagnose.
          HTTP=$(curl -s -o /tmp/rel.json -w "%{http_code}" "${API}/tags/${TAG}" -H "$AUTH")
          REL_ID=$(jq -r '.id // empty' /tmp/rel.json 2>/dev/null || true)
          if [ -z "$REL_ID" ]; then
            echo "ERROR: Release-Lookup fehlgeschlagen (HTTP ${HTTP}) fuer Tag '${TAG}'."
            if [ -z "${TOKEN}" ]; then
              echo "  -> gitea.token ist leer (Actions-Token nicht verfuegbar)."
            else
              echo "  -> Token vorhanden; evtl. fehlt dem Workflow-Token Schreibrecht"
              echo "     (Repo Settings -> Actions -> General -> Workflow permissions = Read/Write),"
              echo "     oder der Tag '${TAG}' stimmt nicht."
            fi
            echo "  Antwort (gekuerzt): $(head -c 300 /tmp/rel.json)"
            exit 1
          fi
          echo "Release ${TAG} gefunden (id ${REL_ID})."

          build_one() {
            name="$1"; file="$2"; platform="$3"; suffix="$4"
            img="${name}:${TAG}-${suffix}"
            out="${name}-${TAG}-${suffix}.tar.gz"
            echo ">> baue ${img} (${platform})"
            docker buildx build --platform "$platform" -f "$file" -t "$img" --load .
            docker save "$img" | gzip > "$out"

            OLD_ID=$(curl -s "${API}/${REL_ID}/assets" -H "$AUTH" \
              | jq -r --arg n "$out" '.[] | select(.name == $n) | .id')
            if [ -n "$OLD_ID" ] && [ "$OLD_ID" != "null" ]; then
              curl -s -X DELETE "${API}/${REL_ID}/assets/${OLD_ID}" -H "$AUTH"
            fi

            curl -sf -X POST "${API}/${REL_ID}/assets?name=${out}" -H "$AUTH" \
              -F "attachment=@${out}" && echo "   angehaengt: ${out}"
          }

          build_one dtrack-stdio Containerfile      linux/amd64 amd64
          build_one dtrack-http  Containerfile.http linux/amd64 amd64
          build_one dtrack-http  Containerfile.http linux/arm64 arm64

      - name: Cleanup
        if: always()
        run: |
          docker buildx rm dtrackbuilder 2>/dev/null || true
          apk del jq 2>/dev/null || true