name: Frontend image

on:
  push:
    tags: ['v*']

concurrency:
  group: frontend-image-publication
  cancel-in-progress: false

jobs:
  publish:
    runs-on: ubuntu-latest
    env:
      IMAGE: nexus.ksv741.keenetic.pro/wealthledger/frontend
      RELEASE_TAG: ${{ gitea.ref_name }}
      REVISION: ${{ gitea.sha }}
      DOCKER_CONFIG: ${{ runner.temp }}/wealthledger-frontend-docker
    steps:
      - uses: https://github.com/actions/checkout@v4
      - uses: https://github.com/actions/setup-node@v4
        with:
          node-version-file: .nvmrc
      - name: Validate release version
        run: |
          node --input-type=commonjs -e 'const p = require("./package.json"); const l = require("./package-lock.json"); if (!/^v\d+\.\d+\.\d+$/.test(process.env.RELEASE_TAG) || process.env.RELEASE_TAG !== `v${p.version}` || l.version !== p.version || l.packages[""].version !== p.version) process.exit(1)'
          test "$(git rev-parse HEAD)" = "$REVISION"
          docker version
          docker buildx version
      - run: npm ci
        env:
          HUSKY: '0'
      - run: npm run verify
        env:
          KNIP_DISABLE_RAW_TRANSFER: '1'
      - name: Login with dedicated Nexus writer
        env:
          REGISTRY_USERNAME: ${{ secrets.NEXUS_USERNAME }}
          REGISTRY_TOKEN: ${{ secrets.NEXUS_PASSWORD }}
        run: |
          test -n "$REGISTRY_USERNAME" && test -n "$REGISTRY_TOKEN"
          install -d -m 700 "$DOCKER_CONFIG"
          printf '%s' "$REGISTRY_TOKEN" | docker login nexus.ksv741.keenetic.pro --username "$REGISTRY_USERNAME" --password-stdin
      - name: Publish immutable release tag
        run: |
          VERSION="${RELEASE_TAG#v}"
          if docker manifest inspect "$IMAGE:$VERSION" >/dev/null 2>manifest-error.log; then
            echo 'Refusing to overwrite an existing release tag'; exit 1
          fi
          if ! grep -Eq 'manifest unknown|no such manifest' manifest-error.log; then
            echo 'Cannot prove tag absence; refusing publication'; exit 1
          fi
          docker buildx build --target production --build-arg VERSION="$VERSION" --build-arg REVISION="$REVISION" --tag "$IMAGE:$VERSION" --metadata-file image-metadata.json --push .
          DIGEST="$(node --input-type=commonjs -p 'require("./image-metadata.json")["containerimage.digest"]')"
          docker pull "$IMAGE@$DIGEST"
          test "$(docker image inspect "$IMAGE@$DIGEST" --format '{{index .Config.Labels "org.opencontainers.image.revision"}}')" = "$REVISION"
          docker run --rm --entrypoint sh "$IMAGE@$DIGEST" -c 'test -s /usr/share/nginx/html/index.html && nginx -t && nginx && wget -q -O /dev/null http://127.0.0.1:8080/'
          printf 'Frontend image: %s@%s\n' "$IMAGE" "$DIGEST"
      - name: Remove registry session
        if: always()
        run: rm -rf "$DOCKER_CONFIG"