name: Release

on:
  release:
    types: [published]

permissions:
  id-token: write  # for OIDC
  contents: read

jobs:
  docker-image:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    needs: [ set-version ]
    steps:
    - name: Checkout
      uses: actions/checkout@v5
      with:
        fetch-depth: 0

    - name: Download updated pyproject.toml
      uses: actions/download-artifact@v4
      with:
        name: pyproject-toml

    - name: 'Get the version'
      id: get_version
      run: echo  "VERSION=${GITHUB_REF/refs\/tags\//}" >> "$GITHUB_OUTPUT"

    - name: 'Login to ACR'
      uses: docker/login-action@v3
      with:
        registry: ${{ vars.REGISTRY_LOGIN_SERVER }}
        username: ${{ vars.REGISTRY_USERNAME }}
        password: ${{ secrets.REGISTRY_PASSWORD }}
    - name: Docker meta
      id: meta
      uses: docker/metadata-action@v4
      with:
        images: ${{ vars.REGISTRY_LOGIN_SERVER }}/gha/mrok
        tags: |
          type=semver,pattern={{major}}.{{minor}}.{{patch}},value=${{ steps.get_version.outputs.VERSION }}
          type=semver,pattern={{major}}.{{minor}},value=${{ steps.get_version.outputs.VERSION }}
          type=semver,pattern={{major}},value=${{ steps.get_version.outputs.VERSION }}
        flavor: |
          latest=false
    - name: Build and push docker image
      id: docker_build
      uses: docker/build-push-action@v3
      with:
        context: .
        file: prod.Dockerfile
        push: true
        tags: ${{ steps.meta.outputs.tags }}
    - name: Docker image digest
      run: echo ${{ steps.docker_build.outputs.digest }}

  dtrack:
    uses: softwareone-platform/ops-template/.github/workflows/dependency-track-python-uv.yml@v1
    with:
      projectName: 'mrok'
    secrets:
      DEPENDENCYTRACK_APIKEY: ${{ secrets.DEPENDENCYTRACK_APIKEY }}

  set-version:
    runs-on: ubuntu-24.04

    steps:
      - uses: actions/checkout@v4

      - name: Export tag
        id: vars
        run: echo tag=${GITHUB_REF#refs/*/} >> $GITHUB_OUTPUT
        if: ${{ github.event_name == 'release' }}

      - name: Update project version
        run: |
          sed -i "s/^version = \".*\"/version = \"$RELEASE_VERSION\"/" pyproject.toml
        env:
          RELEASE_VERSION: ${{ steps.vars.outputs.tag }}
        if: ${{ github.event_name == 'release' }}

      - name: Upload updated pyproject.toml
        uses: actions/upload-artifact@v4
        with:
          name: pyproject-toml
          path: pyproject.toml

  publish:
    runs-on: ubuntu-latest

    needs: [ set-version ]
    steps:
      - name: Check out
        uses: actions/checkout@v4

      - name: Set up the environment
        uses: ./.github/actions/setup-python-env

      - name: Download updated pyproject.toml
        uses: actions/download-artifact@v4
        with:
          name: pyproject-toml

      - name: Build package
        run: uv build

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          repository-url: https://upload.pypi.org/legacy/
