name: Backend image

on:
  push:
    tags: ['v*']

concurrency:
  group: backend-image-publication
  cancel-in-progress: false

jobs:
  publish:
    runs-on: ubuntu-latest
    env:
      IMAGE: git.personal.ksv741.ru/wealthledger/backend
      RELEASE_TAG: ${{ gitea.ref_name }}
      REVISION: ${{ gitea.sha }}
      DOCKER_CONFIG: ${{ runner.temp }}/wealthledger-backend-docker
    steps:
      - uses: https://github.com/actions/checkout@v4
      - uses: https://github.com/actions/setup-node@v4
        with:
          node-version-file: .nvmrc
      - name: Validate release version
        run: |
          node --input-type=commonjs -e 'const p = require("./package.json"); const l = require("./package-lock.json"); if (!/^v\d+\.\d+\.\d+$/.test(process.env.RELEASE_TAG) || process.env.RELEASE_TAG !== `v${p.version}` || l.version !== p.version || l.packages[""].version !== p.version) process.exit(1)'
          test "$(git rev-parse HEAD)" = "$REVISION"
          docker version
          docker buildx version
      - run: npm ci
      - run: npx --no-install prisma generate
      - run: npm run verify
      - run: npm run test:e2e
      - name: Login with dedicated package writer
        env:
          REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
        run: |
          test -n "$REGISTRY_USERNAME" && test -n "$REGISTRY_TOKEN"
          install -d -m 700 "$DOCKER_CONFIG"
          printf '%s' "$REGISTRY_TOKEN" | docker login git.personal.ksv741.ru --username "$REGISTRY_USERNAME" --password-stdin
      - name: Publish immutable release tag
        run: |
          VERSION="${RELEASE_TAG#v}"
          if docker manifest inspect "$IMAGE:$VERSION" >/dev/null 2>manifest-error.log; then
            echo 'Refusing to overwrite an existing release tag'; exit 1
          fi
          if ! grep -Eq 'manifest unknown|no such manifest' manifest-error.log; then
            echo 'Cannot prove tag absence; refusing publication'; exit 1
          fi
          docker buildx build --target production --build-arg VERSION="$VERSION" --build-arg REVISION="$REVISION" --tag "$IMAGE:$VERSION" --metadata-file image-metadata.json --push .
          DIGEST="$(node --input-type=commonjs -p 'require("./image-metadata.json")["containerimage.digest"]')"
          docker pull "$IMAGE@$DIGEST"
          test "$(docker image inspect "$IMAGE@$DIGEST" --format '{{index .Config.Labels "org.opencontainers.image.revision"}}')" = "$REVISION"
          npm run test:container -- "$IMAGE@$DIGEST"
          printf 'Backend image: %s@%s\n' "$IMAGE" "$DIGEST"
      - name: Remove registry session
        if: always()
        run: rm -rf "$DOCKER_CONFIG"