name: release-image

on:
  push:
    branches:
      - release

  workflow_dispatch:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v6.0.2
        with:
          ref: release

      - name: Set up Node
        uses: actions/setup-node@v6.4.0
        with:
          node-version: 24.16.0

      - name: Set up Bun
        uses: oven-sh/setup-bun@v2.2.0
        with:
          bun-version: 1.3.14

      - name: Install Dependencies
        run: bun install --frozen-lockfile

      - name: Cache Astro Build Cache
        uses: actions/cache@v5.0.5
        with:
          path: |
            .astro
            node_modules/.vite
          key: ${{ runner.os }}-astro-${{ hashFiles('**/*.astro', 'astro.config.mjs') }}
          restore-keys: |
            ${{ runner.os }}-astro-

      # - name: Lint Code
      #   run: bun run lint

      - name: Build Project
        run: bun run build

      - name: ntfy Failed
        uses: niniyas/ntfy-action@master
        if: failure()
        with:
          url: '${{ secrets.NTFY_URL }}'
          topic: '${{ secrets.NTFY_TOPIC }}'
          title: 'Test Failure - Site Documentation'
          priority: 4
          headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
          tags: action,failed
          details: 'During release tests failed for building Site Documentation'
          icon: 'https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png'
          actions: '[{"action": "view", "label": "Open Gitea", "url": "https://gitea.alexlebens.dev/alexlebens/site-saralebens/actions?workflow=release-image.yaml", "clear": true}]'
          image: true

  guarddog:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v6.0.2
        with:
          ref: release

      - name: Set up Python
        uses: actions/setup-python@v6.2.0
        with:
          python-version: '3.12.13'

      - name: Install GuardDog
        run: |
          python3 -m pip install --upgrade pip
          python3 -m pip install guarddog

      - name: Run GuardDog
        run: |
          guarddog npm scan ./

      - name: ntfy Failed
        uses: niniyas/ntfy-action@master
        if: failure()
        with:
          url: '${{ secrets.NTFY_URL }}'
          topic: '${{ secrets.NTFY_TOPIC }}'
          title: 'Security Failure - Site Documentation'
          priority: 4
          headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
          tags: action,failed
          details: 'During release guarddog scan failed for Site Documentation'
          icon: 'https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png'
          actions: '[{"action": "view", "label": "Open Gitea", "url": "https://gitea.alexlebens.dev/alexlebens/site-saralebens/actions?workflow=release-image.yaml", "clear": true}]'
          image: true

  semantic-release:
    needs: [ build, guarddog ]
    runs-on: ubuntu-latest
    outputs:
      new-release-published: ${{ steps.semantic.outputs.new-release-published }}
      new-release-version: ${{ steps.semantic.outputs.new-release-version }}
      new-release-git-tag: ${{ steps.semantic.outputs.new-release-git-tag }}
    steps:
      - name: Checkout
        uses: actions/checkout@v6.0.2
        with:
          fetch-depth: 0
          token: ${{ secrets.BOT_TOKEN }}

      - name: Set up Node
        uses: actions/setup-node@v6.4.0
        with:
          node-version: 24.16.0

      - name: Set up Bun
        uses: oven-sh/setup-bun@v2.2.0
        with:
          bun-version: 1.3.14

      - name: Install Dependencies
        run: bun install --frozen-lockfile

      - name: Run Semantic Release
        id: semantic
        env:
          GITEA_TOKEN: ${{ secrets.BOT_TOKEN }}
          GITHUB_TOKEN: ${{ secrets.BOT_TOKEN }}
          NODE_PATH: ${{ github.workspace }}/node_modules
        run: |
          bun run semantic-release

  release-harbor:
    runs-on: ubuntu-latest
    needs: semantic-release
    if: ${{ needs.semantic-release.outputs.new-release-published == 'true' }}
    steps:
      - name: Checkout
        uses: actions/checkout@v6.0.2
        with:
          ref: release

      - name: Login to Harbor Registry
        uses: docker/login-action@v4.2.0
        with:
          registry: ${{ vars.REGISTRY_HOST }}
          username: ${{ vars.REGISTRY_USER }}
          password: ${{ secrets.REGISTRY_SECRET }}

      - name: Login to Docker
        uses: docker/login-action@v4.2.0
        with:
          registry: ${{ vars.DH_REGISTRY }}
          username: ${{ secrets.DH_USERNAME }}
          password: ${{ secrets.DH_TOKEN }}

      - name: Create Kubeconfig
        run: |
          mkdir $HOME/.kube
          echo "${{ secrets.KUBECONFIG_BUILDX }}" > $HOME/.kube/config

      - name: Set up Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@v4.1.0
        with:
          driver: kubernetes
          driver-opts: |
            namespace=gitea
            qemu.install=true
          buildkitd-config-inline: |
            [registry."docker.io"]
              mirrors = ["harbor.alexlebens.net/proxy-hub.docker/"]

      - name: Available Platforms
        run: echo ${{ steps.buildx.outputs.platforms }}

      - name: Extract Metadata
        id: meta
        uses: docker/metadata-action@v6.1.0
        with:
          images: |
            ${{ vars.REGISTRY_HOST }}/images/site-saralebens
          tags: |
            type=ref,event=branch
            type=sha,format=long
            type=raw,value=latest,enable=${{ needs.semantic-release.outputs.new-release-published == 'true' }}
            type=semver,pattern={{version}},value=${{ needs.semantic-release.outputs.new-release-version }}
            type=semver,pattern={{major}}.{{minor}},value=${{ needs.semantic-release.outputs.new-release-version }}
            type=semver,pattern={{major}},value=${{ needs.semantic-release.outputs.new-release-version }}

      - name: Build and Push Image
        uses: docker/build-push-action@v7.2.0
        with:
          context: .
          push: true
          platforms: linux/amd64
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            APP_VERSION=${{ needs.semantic-release.outputs.new-release-version }}
            COMMIT_SHA=${{ github.sha }}
            IS_RELEASE=true
          file: ./Dockerfile
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: ntfy Success
        uses: niniyas/ntfy-action@master
        if: success()
        with:
          url: '${{ secrets.NTFY_URL }}'
          topic: '${{ secrets.NTFY_TOPIC }}'
          title: 'Release Success - Site Documentation'
          priority: 3
          headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
          tags: action,successfully,completed
          details: 'Harbor Image for Site Documentation has been released!'
          icon: 'https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png'

      - name: ntfy Failed
        uses: niniyas/ntfy-action@master
        if: failure()
        with:
          url: '${{ secrets.NTFY_URL }}'
          topic: '${{ secrets.NTFY_TOPIC }}'
          title: 'Release Failure - Site Documentation'
          priority: 4
          headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
          tags: action,failed
          details: 'Harbor Image for Site Documentation has failed to be released.'
          icon: 'https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png'
          actions: '[{"action": "view", "label": "Open Gitea", "url": "https://gitea.alexlebens.dev/alexlebens/site-saralebens/actions?workflow=release-image.yml", "clear": true}]'
          image: true

  release-gitea:
    runs-on: ubuntu-latest
    needs: [ semantic-release, release-harbor ]
    if: |
      always() && 
      needs.semantic-release.outputs.new-release-published == 'true'
    steps:
      - name: Checkout
        uses: actions/checkout@v6.0.2
        with:
          ref: release

      - name: Login to Gitea Registry
        uses: docker/login-action@v4.2.0
        with:
          registry: ${{ vars.REPOSITORY_HOST }}
          username: ${{ gitea.actor }}
          password: ${{ secrets.REPOSITORY_TOKEN }}

      - name: Login to Docker
        uses: docker/login-action@v4.2.0
        with:
          registry: ${{ vars.DH_REGISTRY }}
          username: ${{ secrets.DH_USERNAME }}
          password: ${{ secrets.DH_TOKEN }}

      - name: Create Kubeconfig
        run: |
          mkdir $HOME/.kube
          echo "${{ secrets.KUBECONFIG_BUILDX }}" > $HOME/.kube/config

      - name: Set up Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@v4.1.0
        with:
          driver: kubernetes
          driver-opts: |
            namespace=gitea
            qemu.install=true
          buildkitd-config-inline: |
            [registry."docker.io"]
              mirrors = ["harbor.alexlebens.net/proxy-hub.docker/"]

      - name: Available Platforms
        run: echo ${{ steps.buildx.outputs.platforms }}

      - name: Extract Metadata
        id: meta
        uses: docker/metadata-action@v6.1.0
        with:
          images: |
            ${{ vars.REPOSITORY_HOST }}/${{ gitea.repository }}
          tags: |
            type=ref,event=branch
            type=sha,format=long
            type=raw,value=latest,enable=${{ needs.semantic-release.outputs.new-release-published == 'true' }}
            type=semver,pattern={{version}},value=${{ needs.semantic-release.outputs.new-release-version }}
            type=semver,pattern={{major}}.{{minor}},value=${{ needs.semantic-release.outputs.new-release-version }}
            type=semver,pattern={{major}},value=${{ needs.semantic-release.outputs.new-release-version }}

      - name: Build and Push Image
        uses: docker/build-push-action@v7.2.0
        with:
          context: .
          push: true
          platforms: linux/amd64
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            APP_VERSION=${{ needs.semantic-release.outputs.new-release-version }}
            COMMIT_SHA=${{ github.sha }}
            IS_RELEASE=true
          file: ./Dockerfile
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: ntfy Success
        uses: niniyas/ntfy-action@master
        if: success()
        with:
          url: '${{ secrets.NTFY_URL }}'
          topic: '${{ secrets.NTFY_TOPIC }}'
          title: 'Release Success - Site Documentation'
          priority: 3
          headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
          tags: action,successfully,completed
          details: 'Gitea Image for Site Documentation has been released!'
          icon: 'https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png'

      - name: ntfy Failed
        uses: niniyas/ntfy-action@master
        if: failure()
        with:
          url: '${{ secrets.NTFY_URL }}'
          topic: '${{ secrets.NTFY_TOPIC }}'
          title: 'Release Failure - Site Documentation'
          priority: 4
          headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
          tags: action,failed
          details: 'Gitea Image for Site Documentation has failed to be released.'
          icon: 'https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png'
          actions: '[{"action": "view", "label": "Open Gitea", "url": "https://gitea.alexlebens.dev/alexlebens/site-saralebens/actions?workflow=release-image.yaml", "clear": true}]'
          image: true
