name: services/www - manual release
'on':
  workflow_dispatch:
    inputs:
      tested_sha:
        description: Full tested source commit
        required: true
        type: string
      tested_digest:
        description: OCI sha256 digest from the successful build
        required: true
        type: string
      build_run_id:
        description: Successful WWW build run ID
        required: true
        type: string
permissions:
  contents: read
  actions: read
jobs:
  release:
    runs-on: apex-debian13
    if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/next'
      && github.actor == 'deytenit'
    steps:
    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
      env:
        CHECKOUT_REF: ${{ github.sha }}
        CHECKOUT_SUBMODULES: 'false'
        CHECKOUT_TOKEN: ${{ github.token }}
        PERSIST_CREDENTIALS: 'false'
        HEXTRA_READ_KEY: ''
    - name: Authenticate local registry
      run: python3 .gitea/scripts/docker.py login
      env:
        REGISTRY: git.ermnvldmr.com
        REGISTRY_USER: deytenit
        REGISTRY_TOKEN: ${{ secrets.RELEASE_REGISTRY_TOKEN }}
    - name: Verify successful build and immutable digest
      id: provenance
      run: python3 .gitea/scripts/provenance.py
      env:
        TESTED_SHA: ${{ inputs.tested_sha }}
        TESTED_DIGEST: ${{ inputs.tested_digest }}
        BUILD_RUN_ID: ${{ inputs.build_run_id }}
        PROVENANCE_TOKEN: ${{ github.token }}
    - name: Promote tested digest and create release tag
      env:
        TESTED_SHA: ${{ inputs.tested_sha }}
        TESTED_DIGEST: ${{ inputs.tested_digest }}
        BUILD_RUN_ID: ${{ inputs.build_run_id }}
        PROVENANCE_TOKEN: ${{ github.token }}
        GIT_WRITE_KEY: ${{ secrets.WWW_RELEASE_KEY }}
      run: 'set -euo pipefail

        VERSION=$(bash ci/scripts/calver-release.sh)

        [[ "$VERSION" =~ ^[A-Za-z0-9][A-Za-z0-9._-]*$ ]]

        if git show-ref --verify --quiet "refs/tags/$VERSION"; then exit 1; fi

        docker buildx imagetools create --prefer-index=false "git.ermnvldmr.com/deytenit/ermnvldmr.com/www@$TESTED_DIGEST"
        --tag "git.ermnvldmr.com/deytenit/ermnvldmr.com/www:$VERSION"

        test "$(docker buildx imagetools inspect "git.ermnvldmr.com/deytenit/ermnvldmr.com/www:$VERSION"
        --format ''{{.Manifest.Digest}}'')" = "$TESTED_DIGEST"

        git tag "$VERSION" "$TESTED_SHA"

        python3 .gitea/scripts/git_write.py "refs/tags/$VERSION"

        export VERSION

        mkdir -p .ci

        python3 - <<''RELEASE_PROVENANCE''

        import json, os

        from pathlib import Path

        Path(''.ci/www-release.json'').write_text(json.dumps({''sha'': os.environ[''TESTED_SHA''],
        ''digest'': os.environ[''TESTED_DIGEST''], ''run_id'': os.environ[''BUILD_RUN_ID''],
        ''repository'': ''deytenit/ermnvldmr.com'', ''release_tag'': os.environ[''VERSION'']}))

        RELEASE_PROVENANCE

        '
    - uses: ./.gitea/actions/upload-artifact
      with:
        name: www-release-provenance
        path: .ci/www-release.json
        retention-days: 30