publish-cli-runtime-image.yml

name: publish-cli-runtime-image

on:
  workflow_dispatch:
    inputs:
      promote_v1:
        description: Also refresh the v1 tag.
        required: false
        default: true
        type: boolean
      additional_tag:
        description: Optional extra tag (for example canary or rc1).
        required: false
        default: ''
        type: string
  push:
    branches:
      - main
    paths:
      - tools/cli-runtime/Dockerfile
      - scripts/Invoke-CdevCli.ps1
      - scripts/lib/**
      - cli-contract.json

permissions:
  contents: read
  packages: write

concurrency:
  group: publish-cli-runtime-image-${{ github.ref }}
  cancel-in-progress: false

jobs:
  publish:
    name: Publish CLI Runtime Image
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Resolve deterministic tags
        id: resolve
        shell: bash
        run: |
          set -euo pipefail

          date_utc="$(date -u +%Y%m%d)"
          short_sha="${GITHUB_SHA:0:12}"
          owner_lc="$(printf '%s' "${GITHUB_REPOSITORY_OWNER}" | tr '[:upper:]' '[:lower:]')"
          if [[ -z "$owner_lc" ]]; then
            echo "github repository owner is empty" >&2
            exit 1
          fi
          image_repo="ghcr.io/${owner_lc}/labview-cdev-cli-runtime"
          promote_v1="${{ github.event.inputs.promote_v1 }}"
          additional_tag="${{ github.event.inputs.additional_tag }}"

          if [[ -z "$promote_v1" ]]; then
            promote_v1="true"
          fi

          if [[ -n "$additional_tag" ]] && [[ ! "$additional_tag" =~ ^[A-Za-z0-9._-]+$ ]]; then
            echo "additional_tag must match ^[A-Za-z0-9._-]+$" >&2
            exit 1
          fi

          tags=()
          tags+=("${image_repo}:sha-${short_sha}")
          tags+=("${image_repo}:v1-${date_utc}")
          if [[ "$promote_v1" == "true" ]]; then
            tags+=("${image_repo}:v1")
          fi
          if [[ -n "$additional_tag" ]]; then
            tags+=("${image_repo}:${additional_tag}")
          fi

          {
            echo "date_utc=$date_utc"
            echo "short_sha=$short_sha"
            echo "image_repo=$image_repo"
            echo "tags<<EOF"
            printf '%s\n' "${tags[@]}"
            echo "EOF"
          } >> "$GITHUB_OUTPUT"

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build and push image
        id: build
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ./tools/cli-runtime/Dockerfile
          push: true
          tags: ${{ steps.resolve.outputs.tags }}

      - name: Publish summary
        shell: bash
        run: |
          {
            echo "## cdev CLI Runtime Image Published"
            echo ""
            echo "- Image: \`${{ steps.resolve.outputs.image_repo }}\`"
            echo "- Digest: \`${{ steps.build.outputs.digest }}\`"
            echo "- Commit: \`${GITHUB_SHA}\`"
            echo "- Tags:"
            while IFS= read -r tag; do
              echo "  - \`$tag\`"
            done <<< "${{ steps.resolve.outputs.tags }}"
          } >> "$GITHUB_STEP_SUMMARY"