name: Publish to PyPI & Docker Hub

on:
  release:
    types: [published]

concurrency:
  group: publish-${{ github.ref }}
  cancel-in-progress: false

permissions:
  contents: write

jobs:
  pypi:
    name: Publish to PyPI
    runs-on: ubuntu-latest
    environment: pypi
    permissions:
      id-token: write

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Install build tools
        run: pip install build

      - name: Build package
        run: python -m build

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1

  release-assets:
    name: Upload release archives
    runs-on: ubuntu-latest
    permissions:
      contents: write

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Extract version
        id: version
        run: echo "tag=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

      - name: Build release tarball and zip
        run: |
          VERSION="${{ steps.version.outputs.tag }}"

          # Download Python deps into vendor/
          pip download -r <(python -c "
          import tomllib
          with open('pyproject.toml', 'rb') as f:
              d = tomllib.load(f)
          print('\n'.join(d['project'].get('dependencies', [])))
          ") -d vendor/

          # Create archives with source + install.sh + vendored deps
          # Use --warning=no-file-changed to avoid exit code 1 on concurrent writes
          tar czf "fossilrepo-${VERSION}.tar.gz" \
            --warning=no-file-changed \
            --transform "s,^,fossilrepo-${VERSION}/," \
            --exclude='.git' \
            --exclude='__pycache__' \
            --exclude='*.pyc' \
            --exclude='.ruff_cache' \
            --exclude='node_modules' \
            --exclude='assets' \
            . || [[ $? -eq 1 ]]

          # Zip version
          mkdir -p "/tmp/fossilrepo-${VERSION}"
          rsync -a --exclude='.git' --exclude='__pycache__' --exclude='*.pyc' \
            --exclude='.ruff_cache' --exclude='node_modules' --exclude='assets' \
            . "/tmp/fossilrepo-${VERSION}/"
          cd /tmp && zip -qr "$GITHUB_WORKSPACE/fossilrepo-${VERSION}.zip" "fossilrepo-${VERSION}"

      - name: Upload to GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          VERSION="${{ steps.version.outputs.tag }}"
          gh release upload "${{ github.ref_name }}" \
            "fossilrepo-${VERSION}.tar.gz" \
            "fossilrepo-${VERSION}.zip" \
            --clobber

  docker:
    name: Publish to Docker Hub
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - uses: docker/setup-qemu-action@v3

      - uses: docker/setup-buildx-action@v3

      - uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Extract version from tag
        id: version
        run: echo "tag=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          tags: |
            conflicthq/fossilrepo:${{ steps.version.outputs.tag }}
            conflicthq/fossilrepo:latest
          cache-from: type=gha
          cache-to: type=gha,mode=max
          provenance: true
          sbom: true
