name: "⚒️ Publish Worker (v4)"

on:
  workflow_call:
    inputs:
      image_tag:
        description: The image tag to publish
        type: string
        required: false
        default: ""
      image_registry:
        description: The registry namespace to publish under (e.g. ghcr.io/<owner>)
        type: string
        required: false
        default: ""
  push:
    tags:
      - "re2-test-*"
      - "re2-prod-*"

permissions:
  id-token: write
  packages: write
  contents: read

jobs:
  # check-branch:
  #   runs-on: warp-ubuntu-latest-x64-2x
  #   steps:
  #     - name: Fail if re2-prod-* is pushed from a non-main branch
  #       if: startsWith(github.ref_name, 're2-prod-') && github.base_ref != 'main'
  #       run: |
  #         echo "🚫 re2-prod-* tags can only be pushed from the main branch."
  #         exit 1
  build:
    # needs: check-branch
    strategy:
      matrix:
        package: [supervisor]
    runs-on: warp-ubuntu-latest-x64-2x
    env:
      DOCKER_BUILDKIT: "1"
    steps:
      - name: 🏭 Setup Depot CLI
        uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1.7.1

      - name: ⬇️ Checkout git repo
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: 📦 Get image repo
        id: get_repository
        env:
          PACKAGE: ${{ matrix.package }}
        run: |
          if [[ "$PACKAGE" == *-provider ]]; then
            repo="provider/${PACKAGE%-provider}"
          else
            repo="$PACKAGE"
          fi
          echo "repo=${repo}" >> "$GITHUB_OUTPUT"

      - name: "#️⃣ Get image tag"
        id: get_tag
        uses: ./.github/actions/get-image-tag
        with:
          tag: ${{ inputs.image_tag }}

      - name: 📛 Set tags to push
        id: set_tags
        run: |
          # Resolved by the caller when invoked from publish.yml; falls back to the
          # IMAGE_REGISTRY repository variable (or ghcr.io/<owner>) for the direct
          # push triggers above, so a fork publishes to its own namespace.
          ref_without_tag=${IMAGE_REGISTRY}/${STEPS_GET_REPOSITORY_OUTPUTS_REPO}
          image_tags=$ref_without_tag:${STEPS_GET_TAG_OUTPUTS_TAG}

          if [[ "${STEPS_GET_TAG_OUTPUTS_TAG}" =~ ^v4\.[0-9]+\.[0-9]+$ ]]; then
            image_tags=$image_tags,$ref_without_tag:v4,$ref_without_tag:latest
          fi

          echo "image_tags=${image_tags}" >> "$GITHUB_OUTPUT"
        env:
          IMAGE_REGISTRY: ${{ inputs.image_registry || vars.IMAGE_REGISTRY || format('ghcr.io/{0}', github.repository_owner) }}
          STEPS_GET_REPOSITORY_OUTPUTS_REPO: ${{ steps.get_repository.outputs.repo }}
          STEPS_GET_TAG_OUTPUTS_TAG: ${{ steps.get_tag.outputs.tag }}
          STEPS_GET_TAG_OUTPUTS_IS_SEMVER: ${{ steps.get_tag.outputs.is_semver }}

      - name: 🐙 Login to GitHub Container Registry
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: 🐳 Build image and push to GitHub Container Registry
        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.18.0
        with:
          file: ./apps/${{ matrix.package }}/Containerfile
          platforms: linux/amd64,linux/arm64
          tags: ${{ steps.set_tags.outputs.image_tags }}
          push: true