name: Docker Build and Push

on:
  push:
    tags:
      - 'v*'

jobs:
  test:
    name: Run Tests
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version: 'stable'
          cache: false

      - name: Install dependencies
        run: go mod download

      - name: Run go vet
        run: go vet ./...

      - name: Run tests
        run: go test -v -p 4 ./...

  build:
    name: Build (${{ matrix.platform }})
    runs-on: ${{ matrix.runner }}
    needs: test
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: linux/amd64
            runner: ubuntu-latest, amd64
          - platform: linux/arm64
            runner: ubuntu-latest, arm64

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Prepare platform slug
        run: |
          platform=${{ matrix.platform }}
          echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV

      - name: Extract version and determine release type
        id: version
        run: |
          VERSION=${GITHUB_REF#refs/tags/v}
          echo "VERSION=$VERSION" >> $GITHUB_OUTPUT
          echo "BUILD_DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> $GITHUB_OUTPUT
          echo "COMMIT=${{ github.sha }}" >> $GITHUB_OUTPUT

          if echo "$VERSION" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.]+)?$'; then
            MAJOR=$(echo "$VERSION" | cut -d. -f1)
            MINOR=$(echo "$VERSION" | cut -d. -f2)
            PATCH=$(echo "$VERSION" | cut -d. -f3 | cut -d- -f1)

            echo "MAJOR=$MAJOR" >> $GITHUB_OUTPUT
            echo "MINOR=$MINOR" >> $GITHUB_OUTPUT
            echo "PATCH=$PATCH" >> $GITHUB_OUTPUT

            if echo "$VERSION" | grep -q '-'; then
              PRERELEASE_TAG=$(echo "$VERSION" | cut -d- -f2 | cut -d. -f1)
              echo "IS_PRERELEASE=true" >> $GITHUB_OUTPUT
              echo "PRERELEASE_TAG=$PRERELEASE_TAG" >> $GITHUB_OUTPUT
            else
              echo "IS_PRERELEASE=false" >> $GITHUB_OUTPUT
            fi
          else
            echo "Invalid version format: $VERSION"
            exit 1
          fi

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to Docker Registry
        uses: docker/login-action@v3
        with:
          registry: git.fossy.my.id
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Build and push by digest
        id: build
        uses: docker/build-push-action@v6
        with:
          context: .
          platforms: ${{ matrix.platform }}
          outputs: >-
            type=image,name=git.fossy.my.id/${{ secrets.DOCKER_USERNAME }}/tunnel-please,push-by-digest=true,name-canonical=true,push=true
          build-args: |
            VERSION=${{ steps.version.outputs.VERSION }}
            BUILD_DATE=${{ steps.version.outputs.BUILD_DATE }}
            COMMIT=${{ steps.version.outputs.COMMIT }}

      - name: Export digest
        run: |
          mkdir -p /tmp/digests
          digest="${{ steps.build.outputs.digest }}"
          touch "/tmp/digests/${digest#sha256:}"

      - name: Upload digest
        uses: actions/upload-artifact@v4
        with:
          name: digests-${{ env.PLATFORM_PAIR }}
          path: /tmp/digests/*
          if-no-files-found: error
          retention-days: 1

  merge:
    name: Merge Multi-Arch Manifest
    runs-on: ubuntu-latest
    needs: build

    steps:
      - name: Download all digests
        uses: actions/download-artifact@v4
        with:
          path: /tmp/digests
          pattern: digests-*
          merge-multiple: true

      - name: Extract version and determine release type
        id: version
        run: |
          VERSION=${GITHUB_REF#refs/tags/v}
          echo "VERSION=$VERSION" >> $GITHUB_OUTPUT

          if echo "$VERSION" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.]+)?$'; then
            echo "MAJOR=$(echo "$VERSION" | cut -d. -f1)" >> $GITHUB_OUTPUT
            echo "MINOR=$(echo "$VERSION" | cut -d. -f2)" >> $GITHUB_OUTPUT

            if echo "$VERSION" | grep -q '-'; then
              echo "IS_PRERELEASE=true" >> $GITHUB_OUTPUT
            else
              echo "IS_PRERELEASE=false" >> $GITHUB_OUTPUT
            fi
          else
            echo "Invalid version format: $VERSION"
            exit 1
          fi

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to Docker Registry
        uses: docker/login-action@v3
        with:
          registry: git.fossy.my.id
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Create and push manifest (release)
        working-directory: /tmp/digests
        if: steps.version.outputs.IS_PRERELEASE == 'false'
        run: |
          docker buildx imagetools create \
            -t git.fossy.my.id/${{ secrets.DOCKER_USERNAME }}/tunnel-please:v${{ steps.version.outputs.VERSION }} \
            -t git.fossy.my.id/${{ secrets.DOCKER_USERNAME }}/tunnel-please:release \
            -t git.fossy.my.id/${{ secrets.DOCKER_USERNAME }}/tunnel-please:v${{ steps.version.outputs.MAJOR }}.${{ steps.version.outputs.MINOR }} \
            -t git.fossy.my.id/${{ secrets.DOCKER_USERNAME }}/tunnel-please:v${{ steps.version.outputs.MAJOR }} \
            -t git.fossy.my.id/${{ secrets.DOCKER_USERNAME }}/tunnel-please:latest \
            $(printf 'git.fossy.my.id/${{ secrets.DOCKER_USERNAME }}/tunnel-please@sha256:%s ' *)

      - name: Create and push manifest (pre-release)
        working-directory: /tmp/digests
        if: steps.version.outputs.IS_PRERELEASE == 'true'
        run: |
          docker buildx imagetools create \
            -t git.fossy.my.id/${{ secrets.DOCKER_USERNAME }}/tunnel-please:v${{ steps.version.outputs.VERSION }} \
            -t git.fossy.my.id/${{ secrets.DOCKER_USERNAME }}/tunnel-please:staging \
            $(printf 'git.fossy.my.id/${{ secrets.DOCKER_USERNAME }}/tunnel-please@sha256:%s ' *)