name: Release server

on:
  push:
    tags: ["server-v*"]
  workflow_dispatch:

permissions:
  contents: write
  packages: write
  id-token: write
  attestations: write

concurrency:
  group: server-release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  server:
    name: Test and build server image
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
          cache: true

      - uses: actions/setup-node@v4
        with:
          node-version: 22

      - name: Validate immutable signed server release
        if: startsWith(github.ref, 'refs/tags/server-v')
        shell: bash
        run: |
          set -euo pipefail
          git cat-file -p "$GITHUB_REF_NAME" | grep -q -- '-----BEGIN PGP SIGNATURE-----'
          bash scripts/extract-release-notes.sh \
            "$GITHUB_REF_NAME" \
            CHANGELOG.md \
            release-notes.md

      - name: Test server and web application
        run: |
          go test ./server/...
          go vet ./server/...
          npm run check:web

      - name: Resolve image version
        id: version
        shell: bash
        run: |
          set -euo pipefail
          if [[ "$GITHUB_REF" == refs/tags/server-v* ]]; then
            version="${GITHUB_REF_NAME#server-v}"
          else
            version="sha-${GITHUB_SHA::12}"
          fi
          echo "value=${version}" >> "$GITHUB_OUTPUT"

      - uses: docker/setup-buildx-action@v3

      - name: Log in to GitHub Container Registry
        if: startsWith(github.ref, 'refs/tags/server-v')
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and optionally publish server image
        id: server_image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: Dockerfile
          push: ${{ startsWith(github.ref, 'refs/tags/server-v') }}
          tags: |
            ghcr.io/benya9669/openwrt-rmm-server:${{ steps.version.outputs.value }}
            ghcr.io/benya9669/openwrt-rmm-server:latest
          labels: |
            org.opencontainers.image.title=OpenWrt RMM Server
            org.opencontainers.image.source=https://github.com/Benya9669/openwrt-rmm
            org.opencontainers.image.revision=${{ github.sha }}
            org.opencontainers.image.version=${{ steps.version.outputs.value }}
            org.opencontainers.image.licenses=AGPL-3.0-only
          build-args: |
            RMM_SERVER_VERSION=${{ steps.version.outputs.value }}
            RMM_SOURCE_REVISION=${{ github.sha }}
            RMM_STABLE_AGENT_VERSION=0.6.8
          cache-from: type=gha,scope=rmm-server
          cache-to: type=gha,mode=max,scope=rmm-server
          provenance: mode=max
          sbom: true

      - name: Build and optionally publish tunnel image
        id: tunnel_image
        uses: docker/build-push-action@v6
        with:
          context: deploy/tunnel
          file: deploy/tunnel/Dockerfile
          push: ${{ startsWith(github.ref, 'refs/tags/server-v') }}
          tags: |
            ghcr.io/benya9669/openwrt-rmm-tunnel:${{ steps.version.outputs.value }}
            ghcr.io/benya9669/openwrt-rmm-tunnel:latest
          labels: |
            org.opencontainers.image.title=OpenWrt RMM Tunnel
            org.opencontainers.image.source=https://github.com/Benya9669/openwrt-rmm
            org.opencontainers.image.revision=${{ github.sha }}
            org.opencontainers.image.version=${{ steps.version.outputs.value }}
            org.opencontainers.image.licenses=AGPL-3.0-only
          cache-from: type=gha,scope=rmm-tunnel
          cache-to: type=gha,mode=max,scope=rmm-tunnel
          provenance: mode=max
          sbom: true

      - uses: sigstore/cosign-installer@v3
        if: startsWith(github.ref, 'refs/tags/server-v')

      - name: Sign published images with GitHub OIDC
        if: startsWith(github.ref, 'refs/tags/server-v')
        shell: bash
        run: |
          set -euo pipefail
          cosign sign --yes \
            "ghcr.io/benya9669/openwrt-rmm-server@${{ steps.server_image.outputs.digest }}"
          cosign sign --yes \
            "ghcr.io/benya9669/openwrt-rmm-tunnel@${{ steps.tunnel_image.outputs.digest }}"

      - name: Attest server image provenance
        if: startsWith(github.ref, 'refs/tags/server-v')
        uses: actions/attest-build-provenance@v2
        with:
          subject-name: ghcr.io/benya9669/openwrt-rmm-server
          subject-digest: ${{ steps.server_image.outputs.digest }}
          push-to-registry: true

      - name: Attest tunnel image provenance
        if: startsWith(github.ref, 'refs/tags/server-v')
        uses: actions/attest-build-provenance@v2
        with:
          subject-name: ghcr.io/benya9669/openwrt-rmm-tunnel
          subject-digest: ${{ steps.tunnel_image.outputs.digest }}
          push-to-registry: true

      - name: Create GitHub release
        if: startsWith(github.ref, 'refs/tags/server-v')
        env:
          GH_TOKEN: ${{ github.token }}
        shell: bash
        run: |
          set -euo pipefail
          if gh release view "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
            echo "release already exists; published server tags are immutable" >&2
            exit 1
          fi
          gh release create "$GITHUB_REF_NAME" \
            --repo "$GITHUB_REPOSITORY" \
            --notes-file release-notes.md \
            --title "OpenWrt RMM Server ${GITHUB_REF_NAME#server-v}"