name: Docker Publish (Tags)

on:
  push:
    tags:
      - 'v*.*.*'
  workflow_dispatch:

env:
  REGISTRY: docker.io
  IMAGE_NAME: doobidoo/mcp-memory-service

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      id-token: write
      attestations: write

    steps:
    - name: Checkout repository
      uses: actions/checkout@v4

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3

    - name: Debug - Check required files for Docker Hub build
      run: |
        echo "=== Checking required files for Docker Hub build ==="
        echo "Standard Dockerfile exists:" && ls -la tools/docker/Dockerfile
        echo "Slim Dockerfile exists:" && ls -la tools/docker/Dockerfile.slim
        echo "Source directory exists:" && ls -la src/
        echo "Entrypoint scripts exist:" && ls -la tools/docker/docker-entrypoint*.sh
        echo "Utils scripts exist:" && ls -la scripts/utils/
        echo "pyproject.toml exists:" && ls -la pyproject.toml
        echo "uv.lock exists:" && ls -la uv.lock

    - name: Log in to Docker Hub
      if: github.event_name != 'pull_request'
      uses: docker/login-action@v3
      with:
        registry: ${{ env.REGISTRY }}
        username: ${{ secrets.DOCKER_USERNAME }}
        password: ${{ secrets.DOCKER_PASSWORD }}

    - name: Extract metadata (Standard)
      id: meta
      uses: docker/metadata-action@v5
      with:
        images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
        tags: |
          type=ref,event=branch
          type=ref,event=pr
          type=semver,pattern={{version}}
          type=semver,pattern={{major}}.{{minor}}
          type=semver,pattern={{major}}
          type=raw,value=latest,enable={{is_default_branch}}

    - name: Extract metadata (Slim)
      id: meta-slim
      uses: docker/metadata-action@v5
      with:
        images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
        tags: |
          type=ref,event=branch,suffix=-slim
          type=ref,event=pr,suffix=-slim
          type=semver,pattern={{version}},suffix=-slim
          type=semver,pattern={{major}}.{{minor}},suffix=-slim
          type=semver,pattern={{major}},suffix=-slim
          type=raw,value=slim,enable={{is_default_branch}}

    - name: Build and push Standard Docker image
      id: build-and-push
      uses: docker/build-push-action@v5
      with:
        context: .
        file: ./tools/docker/Dockerfile
        platforms: linux/amd64,linux/arm64
        push: ${{ github.event_name != 'pull_request' }}
        tags: ${{ steps.meta.outputs.tags }}
        labels: ${{ steps.meta.outputs.labels }}
        cache-from: type=gha,scope=standard
        cache-to: type=gha,mode=max,scope=standard
        build-args: |
          SKIP_MODEL_DOWNLOAD=true
        outputs: type=registry

    - name: Build and push Slim Docker image
      id: build-and-push-slim
      uses: docker/build-push-action@v5
      with:
        context: .
        file: ./tools/docker/Dockerfile.slim
        platforms: linux/amd64,linux/arm64
        push: ${{ github.event_name != 'pull_request' }}
        tags: ${{ steps.meta-slim.outputs.tags }}
        labels: ${{ steps.meta-slim.outputs.labels }}
        cache-from: type=gha,scope=slim
        cache-to: type=gha,mode=max,scope=slim
        build-args: |
          SKIP_MODEL_DOWNLOAD=true
        outputs: type=registry

    - name: Generate artifact attestation (Standard)
      if: github.event_name != 'pull_request'
      uses: actions/attest-build-provenance@v1
      with:
        subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME}}
        subject-digest: ${{ steps.build-and-push.outputs.digest }}
        push-to-registry: true
      continue-on-error: true  # Don't fail the workflow if attestation fails

    - name: Generate artifact attestation (Slim)
      if: github.event_name != 'pull_request'
      uses: actions/attest-build-provenance@v1
      with:
        subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME}}
        subject-digest: ${{ steps.build-and-push-slim.outputs.digest }}
        push-to-registry: true
      continue-on-error: true  # Don't fail the workflow if attestation fails