name: Container

on:
  workflow_call:
    inputs:
      ref:
        description: Exact commit SHA to build and validate
        required: true
        type: string

permissions:
  contents: read
  security-events: write

jobs:
  container:
    runs-on: ubuntu-26.04
    timeout-minutes: 45
    env:
      CPR_IMAGE: codex-proxy-rs:ci-${{ inputs.ref }}
      TRIVY_QUIET: 'true'
      TRIVY_SKIP_VERSION_CHECK: 'true'
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ inputs.ref }}

      - name: Setup Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1

      - name: Restore Cargo snapshot
        id: cargo-cache
        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ${{ runner.temp }}/container-cargo
          # 同一平台和依赖复用快照，源码变化由 Cargo 指纹判定是否重编译
          key: container-cargo-v3-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('backend/Cargo.lock', 'backend/rust-toolchain.toml', 'backend/**/Cargo.toml', 'backend/.cargo/config.toml', 'deploy/Dockerfile', '.github/actions/cargo-cache/Dockerfile') }}
          restore-keys: |
            container-cargo-v3-${{ runner.os }}-${{ runner.arch }}-
            container-cargo-v2-${{ runner.os }}-${{ runner.arch }}-

      - name: Restore Cargo mounts to BuildKit
        id: cargo-restore
        uses: ./.github/actions/cargo-cache
        with:
          operation: restore
          builder: ${{ steps.buildx.outputs.name }}
          path: ${{ runner.temp }}/container-cargo
          architecture: amd64

      - name: Build runtime image
        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        with:
          context: .
          file: deploy/Dockerfile
          target: runtime
          load: true
          tags: ${{ env.CPR_IMAGE }}
          no-cache-filters: |
            runtime-base
            runtime
          cache-from: type=gha,scope=runtime-ci
          cache-to: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' && 'type=gha,mode=max,scope=runtime-ci' || '' }}

      - name: Verify runtime image
        uses: ./.github/actions/verify-container
        with:
          image: ${{ env.CPR_IMAGE }}
          platform: linux/amd64
          artifact-name: container-diagnostics-${{ github.run_id }}-${{ github.run_attempt }}-amd64

      # 构建层命中时 mount 仍可能为空，只有实际检查过内容的快照才允许保存。
      - name: Export Cargo snapshot
        if: >-
          github.event_name == 'push' && github.ref == 'refs/heads/main' &&
          (steps.cargo-cache.outputs.cache-hit != 'true' || steps.cargo-restore.outputs.usable != 'true')
        id: cargo-snapshot
        uses: ./.github/actions/cargo-cache
        with:
          operation: snapshot
          builder: ${{ steps.buildx.outputs.name }}
          path: ${{ runner.temp }}/container-cargo
          architecture: amd64

      - name: Save Cargo snapshot
        if: steps.cargo-snapshot.outputs.usable == 'true' && steps.cargo-cache.outputs.cache-hit != 'true'
        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ${{ runner.temp }}/container-cargo
          key: ${{ steps.cargo-cache.outputs.cache-primary-key }}