# Manual compatibility publisher for the Crucible image.
# Normal release publishing happens in build-image.yml on v* tags; this is the
# break-glass / re-publish path, triggered by hand.
#
# Daemonless: built by Nix (`nix build .#image`) and pushed with skopeo from the
# OCI tarball. No `docker build`/`docker login` involved.
name: publish-image

on:
  workflow_dispatch:

env:
  REGISTRY: registry.westgate.pw
  IMAGE: deployment/crucible

jobs:
  publish:
    runs-on: nix-docker
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }

      - name: Resolve tag
        id: tag
        run: echo "sha=$(git rev-parse --short=12 HEAD)" >> "$GITHUB_OUTPUT"

      - name: Build OCI image (daemonless)
        run: nix build .#image

      - name: Publish image
        env:
          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
        run: |
          nix shell nixpkgs#skopeo -c skopeo copy \
            --dest-creds "${REGISTRY_USER}:${REGISTRY_PASSWORD}" \
            docker-archive:result \
            "docker://${REGISTRY}/${IMAGE}:${{ steps.tag.outputs.sha }}"

      - name: Emit release fragment
        run: |
          FRAG_REPO=sow-tools \
          FRAG_SHA=${{ steps.tag.outputs.sha }} \
          FRAG_ARTIFACT="${REGISTRY}/${IMAGE}:${{ steps.tag.outputs.sha }}" \
          FRAG_URL="${REGISTRY}/${IMAGE}" \
          FRAG_RUN_ID=${{ gitea.run_id }} \
          bash scripts/emit-release-fragment.sh
      - uses: actions/upload-artifact@v3
        with: { name: release-fragment, path: release-fragment.json }