approve-container-release:
  stage: package
  image: alpine:3.22
  rules:
    - if: '$CI_PIPELINE_SOURCE == "web" && $RELEASE_VERSION =~ /^\d+\.\d+\.\d+$/'
      when: manual
  environment:
    name: overlord-container-release
  script:
    - echo "Approved container release ${RELEASE_VERSION}"

container-build:
  stage: package
  image: docker:27.5.1-cli
  services:
    - name: docker:27.5.1-dind
      command: ["--mtu=1400"]
  needs:
    - approve-container-release
  rules:
    - if: '$CI_PIPELINE_SOURCE == "web" && $RELEASE_VERSION =~ /^\d+\.\d+\.\d+$/'
  parallel:
    matrix:
      - PLATFORM: linux/amd64
        ARCH: amd64
        RUNNER_TAG: saas-linux-small-amd64
      - PLATFORM: linux/arm64
        ARCH: arm64
        RUNNER_TAG: saas-linux-small-arm64
  tags:
    - $RUNNER_TAG
  variables:
    DOCKER_TLS_CERTDIR: /certs
  before_script:
    - echo "$CI_REGISTRY_PASSWORD" | docker login --username "$CI_REGISTRY_USER" --password-stdin "$CI_REGISTRY"
    - docker context create ci-builder
    - docker buildx create ci-builder --driver docker-container --use
    - docker buildx inspect --bootstrap
  script:
    - |
      set -eu
      client_version=$(sed -nE 's/.*AgentVersion[[:space:]]*=[[:space:]]*"([0-9]+\.[0-9]+\.[0-9]+)".*/\1/p' Overlord-Client/cmd/agent/config/config.go | head -n1)
      server_version=$(sed -nE 's/.*SERVER_VERSION[[:space:]]*=[[:space:]]*"([0-9]+\.[0-9]+\.[0-9]+)".*/\1/p' Overlord-Server/src/version.ts | head -n1)
      package_version=$(sed -nE 's/[[:space:]]*"version":[[:space:]]*"([0-9]+\.[0-9]+\.[0-9]+)".*/\1/p' Overlord-Server/package.json | head -n1)
      test -n "$client_version"
      test "$client_version" = "$server_version"
      test "$client_version" = "$package_version"
      test "$RELEASE_VERSION" = "$client_version"
    - |
      set -eu
      metadata_file=$(mktemp)
      docker buildx build \
        --file Dockerfile \
        --platform "$PLATFORM" \
        --label "org.opencontainers.image.source=$CI_PROJECT_URL" \
        --label "org.opencontainers.image.revision=$CI_COMMIT_SHA" \
        --cache-from "type=registry,ref=$CI_REGISTRY_IMAGE:buildcache-$ARCH" \
        --cache-to "type=registry,ref=$CI_REGISTRY_IMAGE:buildcache-$ARCH,mode=max" \
        --output "type=image,name=$CI_REGISTRY_IMAGE,push-by-digest=true,name-canonical=true,push=true" \
        --metadata-file "$metadata_file" \
        .
      digest=$(sed -nE 's/.*"containerimage.digest"[[:space:]]*:[[:space:]]*"sha256:([a-f0-9]+)".*/\1/p' "$metadata_file" | head -n1)
      test -n "$digest"
      mkdir -p digests
      touch "digests/$digest"
  artifacts:
    expire_in: 1 day
    paths:
      - digests/

container-publish:
  stage: release
  image: docker:27.5.1-cli
  services:
    - name: docker:27.5.1-dind
      command: ["--mtu=1400"]
  tags:
    - saas-linux-small-amd64
  needs:
    - job: container-build
      artifacts: true
  rules:
    - if: '$CI_PIPELINE_SOURCE == "web" && $RELEASE_VERSION =~ /^\d+\.\d+\.\d+$/'
  variables:
    DOCKER_TLS_CERTDIR: /certs
  before_script:
    - echo "$CI_REGISTRY_PASSWORD" | docker login --username "$CI_REGISTRY_USER" --password-stdin "$CI_REGISTRY"
    - docker context create ci-builder
    - docker buildx create ci-builder --driver docker-container --use
    - docker buildx inspect --bootstrap
  script:
    - |
      set -eu
      major=${RELEASE_VERSION%%.*}
      remainder=${RELEASE_VERSION#*.}
      minor=${remainder%%.*}
      set --
      for digest_file in digests/*; do
        set -- "$@" "$CI_REGISTRY_IMAGE@sha256:$(basename "$digest_file")"
      done
      test "$#" -eq 2
      docker buildx imagetools create \
        --tag "$CI_REGISTRY_IMAGE:$RELEASE_VERSION" \
        --tag "$CI_REGISTRY_IMAGE:$major.$minor" \
        --tag "$CI_REGISTRY_IMAGE:$major" \
        --tag "$CI_REGISTRY_IMAGE:latest" \
        "$@"
      docker buildx imagetools inspect "$CI_REGISTRY_IMAGE:$RELEASE_VERSION"