release.yml

name: release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: read

jobs:
  contract:
    name: Release Contract
    runs-on: ubuntu-24.04
    outputs:
      version: ${{ steps.version.outputs.value }}
      candidate: ${{ steps.version.outputs.candidate }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Setup Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.13"

      - name: Match source contract to tag
        id: version
        shell: bash
        run: |
          release_version="${GITHUB_REF_NAME#v}"
          source_version="$(sed -n 's/^IMAGE_TAG=//p' .env.docker.example)"
          if [[ -z "$release_version" || "$source_version" != "$release_version" ]]; then
            echo "Tag version $release_version does not match source IMAGE_TAG $source_version." >&2
            exit 1
          fi
          echo "value=$release_version" >> "$GITHUB_OUTPUT"
          echo "candidate=$release_version-candidate-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT" >> "$GITHUB_OUTPUT"
          echo "PUBLIC_RELEASE_VERSION=$release_version" >> "$GITHUB_ENV"

      - name: Setup uv
        uses: astral-sh/setup-uv@v7

      - name: Install contract dependencies
        run: uv sync --locked --extra dev

      - name: Verify public release contract
        shell: bash
        run: |
          # Keep this gate independent of application fixtures and coverage.
          uv run --locked --extra dev pytest tests/unit/test_public_release_contract.py --noconftest --no-cov -q

  images:
    name: ${{ matrix.name }}
    runs-on: ubuntu-latest
    needs: contract
    permissions:
      contents: read
      packages: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: API image
            image: opencli-admin-api
            context: .
            file: Dockerfile
            build_args: |
              IMAGE_TAG=__VERSION__
            suffix: ""
          - name: Frontend image
            image: opencli-admin-frontend
            context: ./frontend
            file: ./frontend/Dockerfile
            build_args: |
              BACKEND_URL=http://api:8000
            suffix: ""
          - name: Agent image
            image: opencli-admin-agent
            context: .
            file: ./agent/Dockerfile
            build_args: ""
            suffix: ""
          - name: Interactive Chrome image
            image: opencli-admin-chrome
            context: .
            file: ./chrome/Dockerfile
            build_args: ""
            suffix: ""
          - name: Agent Chrome image
            image: opencli-admin-agent
            context: .
            file: ./agent/Dockerfile
            suffix: "-chrome"
            build_args: |
              INSTALL_CHROME=true
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Resolve build arguments
        id: build_args
        shell: bash
        env:
          MATRIX_BUILD_ARGS: ${{ matrix.build_args }}
          RELEASE_VERSION: ${{ needs.contract.outputs.version }}
        run: |
          {
            echo "value<<EOF"
            printf '%s\n' "$MATRIX_BUILD_ARGS" | sed "s/__VERSION__/$RELEASE_VERSION/g"
            echo "EOF"
          } >> "$GITHUB_OUTPUT"

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          context: ${{ matrix.context }}
          file: ${{ matrix.file }}
          platforms: linux/amd64,linux/arm64
          push: true
          build-args: ${{ steps.build_args.outputs.value }}
          tags: ghcr.io/${{ github.repository_owner }}/${{ matrix.image }}:${{ needs.contract.outputs.candidate }}${{ matrix.suffix }}
          cache-from: type=gha,scope=${{ matrix.name }}
          cache-to: type=gha,mode=max,scope=${{ matrix.name }}
          provenance: mode=max
          sbom: true

  published-image-smoke:
    name: Published Image Recovery Smoke
    runs-on: ubuntu-24.04
    needs:
      - contract
      - images
    permissions:
      contents: read
      packages: read
    env:
      API_AUTH_TOKEN: ci-release-token
      BOOTSTRAP_ADMIN_TOKEN: ci-bootstrap-admin-token
      CREDENTIAL_ENCRYPTION_KEY: MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDA=
      COMPOSE_PROJECT_NAME: opencli-admin-release-${{ github.run_id }}-${{ github.run_attempt }}
      DOCKER_IMAGE_NAMESPACE: ${{ github.repository_owner }}
      IMAGE_TAG: ${{ needs.contract.outputs.candidate }}
      IMAGE_PREFIX: ghcr.io/${{ github.repository_owner }}
      CANDIDATE_TAG: ${{ needs.contract.outputs.candidate }}
      OPENCLI_DAEMON_GATE_INCLUDE_BUILD_OVERRIDE: "0"
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Setup Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.13"

      - name: Generate ephemeral test secret
        run: echo "SECRET_KEY=$(openssl rand -hex 32)" >> "$GITHUB_ENV"

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Verify Docker systemd precondition
        run: sudo systemctl is-active --quiet docker.service

      - name: Validate published-image Compose
        run: docker compose --env-file .env.docker.example -f docker-compose.yml config --quiet

      - name: Pull tag images
        run: docker compose --env-file .env.docker.example -f docker-compose.yml pull api frontend agent-1

      - name: Start published stack without building
        run: docker compose --env-file .env.docker.example -f docker-compose.yml up -d --no-build --wait api frontend agent-1

      - name: Verify published endpoints
        run: |
          curl --fail --silent --show-error http://localhost:3010/login >/dev/null
          curl --fail --silent --show-error http://localhost:8031/health >/dev/null
          curl --fail --silent --show-error \
            -H "Authorization: Bearer ci-bootstrap-admin-token" \
            -H "X-API-Token: ci-release-token" \
            http://localhost:8031/api/v1/auth/me |
            python -c 'import json,sys; assert json.load(sys.stdin)["data"]["subject"] == "bootstrap-admin"'

      - name: Verify both published agent variants
        run: bash .github/scripts/verify-candidate-agent-images.sh

      - name: Verify published Docker daemon restart recovery
        run: bash .github/scripts/verify-daemon-restart.sh

      - name: Show published logs on failure
        if: failure()
        run: docker compose --env-file .env.docker.example -f docker-compose.yml logs --tail=200 api frontend agent-1

      - name: Stop published stack
        if: always()
        run: docker compose --env-file .env.docker.example -f docker-compose.yml down -v

  promote:
    name: Promote Verified Images
    runs-on: ${{ vars.CI_5070X_ENABLED == 'true' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && 'ci-5070x-docker' || 'ubuntu-latest' }}
    needs:
      - contract
      - published-image-smoke
    permissions:
      contents: read
      packages: write
    steps:
      - name: Set up Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Promote candidate manifests
        shell: bash
        env:
          IMAGE_PREFIX: ghcr.io/${{ github.repository_owner }}
          RELEASE_VERSION: ${{ needs.contract.outputs.version }}
          CANDIDATE_TAG: ${{ needs.contract.outputs.candidate }}
        run: |
          # Candidate tags are retained as release audit artifacts. GHCR deletes
          # package versions by shared manifest/digest, so post-promotion deletion
          # can also remove the newly attached formal/latest tags.
          for image in opencli-admin-api opencli-admin-frontend opencli-admin-chrome; do
            docker buildx imagetools create \
              --tag "$IMAGE_PREFIX/$image:$RELEASE_VERSION" \
              --tag "$IMAGE_PREFIX/$image:latest" \
              "$IMAGE_PREFIX/$image:$CANDIDATE_TAG"
          done
          docker buildx imagetools create \
            --tag "$IMAGE_PREFIX/opencli-admin-agent:$RELEASE_VERSION" \
            --tag "$IMAGE_PREFIX/opencli-admin-agent:latest" \
            "$IMAGE_PREFIX/opencli-admin-agent:$CANDIDATE_TAG"
          docker buildx imagetools create \
            --tag "$IMAGE_PREFIX/opencli-admin-agent:$RELEASE_VERSION-chrome" \
            --tag "$IMAGE_PREFIX/opencli-admin-agent:latest-chrome" \
            "$IMAGE_PREFIX/opencli-admin-agent:$CANDIDATE_TAG-chrome"

  github-release:
    name: GitHub Release
    runs-on: ubuntu-latest
    needs: promote
    permissions:
      contents: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Create release
        uses: softprops/action-gh-release@v2
        with:
          generate_release_notes: true
          files: |
            docker-compose.yml
            docker-compose.build.yml
            .env.docker.example
            scripts/install.sh
            scripts/install.ps1