name: Release 镜像

on:
  push:
    branches: [main]
    tags: ["v*"]
  workflow_dispatch:

env:
  REGISTRY: registry.cn-hangzhou.aliyuncs.com
  IMAGE: registry.cn-hangzhou.aliyuncs.com/skymirror/fileshare

jobs:
  test:
    name: 测试（推送前置门禁）
    runs-on: ubuntu-latest
    container:
      image: golang:1.27.1-alpine
    timeout-minutes: 30
    steps:
      - name: 安装工具并检出
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          sed -i 's/dl-cdn.alpinelinux.org/mirrors.aliyun.com/g' /etc/apk/repositories
          apk add --no-cache git curl bash >/dev/null
          git clone --depth=1 --branch "$GITHUB_REF_NAME" \
            "https://oauth2:${GITHUB_TOKEN}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git" .

      - name: go vet + go test
        working-directory: server
        env:
          GOCACHE: /tmp/.gocache
          GOMODCACHE: /tmp/.gomodcache
          CGO_ENABLED: "0"
        run: |
          go vet ./...
          go test ./... -count=1

  build-push:
    name: 多架构构建并推送 ACR
    needs: test
    runs-on: ubuntu-latest
    timeout-minutes: 60
    steps:
      - name: 安装工具并检出
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          sed -i 's/dl-cdn.alpinelinux.org/mirrors.aliyun.com/g' /etc/apk/repositories
          apk add --no-cache git curl bash >/dev/null
          git clone --depth=1 --branch "$GITHUB_REF_NAME" \
            "https://oauth2:${GITHUB_TOKEN}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git" .
          # 嵌入产物同步（保证二进制内前端与仓库一致）
          if [ -f web-embed/index.html ]; then :; fi

      - name: 安装 Docker CLI（挂宿主 daemon）
        run: apk add --no-cache docker-cli buildx >/dev/null

      - name: 计算 tag 与平台
        id: meta
        env:
          REF: ${{ gitea.ref }}
        run: |
          case "$REF" in
            refs/tags/v*)
              VER="${REF#refs/tags/v}"
              echo "tags=${IMAGE}:${VER} ${IMAGE}:latest" >> "$GITHUB_OUTPUT"
              echo "发布 tag: ${VER} + latest" ;;
            *)
              echo "tags=${IMAGE}:latest" >> "$GITHUB_OUTPUT"
              echo "main 构建: latest" ;;
          esac

      - name: 登录阿里云 ACR
        env:
          ACR_USER: ${{ secrets.ACR_USERNAME }}
          ACR_PASS: ${{ secrets.ACR_PASSWORD }}
        run: |
          PASS_LEN=${#ACR_PASS}
          echo "ACR 用户: $ACR_USER (密码 ${PASS_LEN} 位)"
          printf '%s' "$ACR_PASS" | docker login "$REGISTRY" -u "$ACR_USER" --password-stdin

      - name: 多架构构建并推送
        env:
          TAGS: ${{ steps.meta.outputs.tags }}
        # provenance/sbom 必须关：阿里云 ACR 不识别 OCI empty manifest（attestation），
        # 否则报 "denied: unknown manifest class for application/vnd.oci.empty.v1+json"
        run: |
          ARGS=""
          for t in $TAGS; do ARGS="$ARGS -t $t"; done
          docker buildx build \
            --builder default \
            --platform linux/amd64,linux/arm64 \
            --provenance=false --sbom=false \
            --push \
            -f deploy/Dockerfile \
            $ARGS \
            .

      - name: 校验远程 manifest（双架构）
        run: docker buildx imagetools inspect "${IMAGE}:latest" | grep -E "linux/amd64|linux/arm64"