name: release

# Publishes an immutable, version-tagged image on ghcr.io (spec 10.1).
# Ordinary commits do not publish anything — only a pushed tag matching
# vX.Y.Z does. That tag is the single source the version comes from: it goes
# into both the image tag and the panel binary's -ldflags version, so the two
# can never drift apart (the invariant restore's version check in spec 7.5.A
# depends on).
#
# Native per-architecture builds (see docs/development.md), not qemu:
# running the full Postfix/OpenDKIM stack under emulation for the e2e gate
# below is impractically slow. Each arch builds, e2e-gates and pushes its own
# tag on its own native runner; a merge job then combines them into the one
# manifest tag documented in deploy/docker-compose.yml. "test, then push" (not
# push-by-digest then test) is deliberate: it means the bytes that get tagged
# are exactly the bytes that passed e2e, at the cost of per-arch tags lingering
# in the registry as a side effect (harmless — the version tag's immutability,
# spec 10.1, is about that tag, not these).
on:
  push:
    tags:
      - "v[0-9]+.[0-9]+.[0-9]+"
  workflow_dispatch:

permissions:
  contents: read
  packages: write

jobs:
  prepare:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.version.outputs.version }}
    steps:
      - name: Derive version from tag
        id: version
        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

  build:
    needs: prepare
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: ubuntu-latest
            arch: amd64
          - runner: ubuntu-24.04-arm
            arch: arm64
    runs-on: ${{ matrix.runner }}
    steps:
      - uses: actions/checkout@v4

      - uses: docker/setup-buildx-action@v3

      - name: Build image (native, loaded locally for the e2e gate)
        uses: docker/build-push-action@v6
        with:
          context: .
          file: build/Dockerfile
          load: true
          provenance: false
          build-args: |
            VERSION=${{ needs.prepare.outputs.version }}
          tags: selfpost:e2e

      - uses: actions/setup-go@v5
        with:
          go-version: "1.26"
          cache-dependency-path: test/e2e/go.sum

      - name: e2e (gates publishing — see docs/development.md)
        run: cd test/e2e && go test -v -timeout 20m ./...

      - name: Log in to ghcr.io
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Push per-arch tag
        run: |
          docker tag selfpost:e2e "ghcr.io/${{ github.repository }}:${{ needs.prepare.outputs.version }}-${{ matrix.arch }}"
          docker push "ghcr.io/${{ github.repository }}:${{ needs.prepare.outputs.version }}-${{ matrix.arch }}"

  merge:
    needs: [prepare, build]
    runs-on: ubuntu-latest
    steps:
      - uses: docker/setup-buildx-action@v3

      - name: Log in to ghcr.io
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Merge per-arch tags into the version manifest
        run: |
          docker buildx imagetools create \
            -t "ghcr.io/${{ github.repository }}:${{ needs.prepare.outputs.version }}" \
            "ghcr.io/${{ github.repository }}:${{ needs.prepare.outputs.version }}-amd64" \
            "ghcr.io/${{ github.repository }}:${{ needs.prepare.outputs.version }}-arm64"