name: Release Ship

on:
  workflow_call:
    inputs:
      version:
        description: Release version
        required: true
        type: string

permissions:
  contents: write
  packages: write

jobs:
  docker:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Download Docker slices
        uses: actions/download-artifact@v4
        with:
          pattern: docker-slice-*
          path: slices
          merge-multiple: true

      - name: Assemble docker context
        run: |
          set -euo pipefail
          rm -rf docker_context
          mkdir -p docker_context
          cp -a slices/* docker_context/
          find docker_context -type f -exec ls -lh {} \;

      - name: Setup QEMU
        uses: docker/setup-qemu-action@v3

      - name: Setup Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Image names & tags
        id: img
        run: |
          set -euo pipefail
          OWNER="$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')"
          VERSION="${{ inputs.version }}"
          SERVER="ghcr.io/${OWNER}/orbien-server"
          CLIENT="ghcr.io/${OWNER}/orbien"
          {
            echo "server_tags<<EOF"
            echo "${SERVER}:${VERSION}"
            if [[ "$VERSION" != *-* ]]; then
              echo "${SERVER}:latest"
            fi
            echo "EOF"
            echo "client_tags<<EOF"
            echo "${CLIENT}:${VERSION}"
            if [[ "$VERSION" != *-* ]]; then
              echo "${CLIENT}:latest"
            fi
            echo "EOF"
          } >> "$GITHUB_OUTPUT"

      - name: Build & push orbien-server
        uses: docker/build-push-action@v6
        with:
          context: .
          file: docker/Dockerfile.server
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.img.outputs.server_tags }}
          labels: |
            org.opencontainers.image.title=orbien-server
            org.opencontainers.image.description=Orbien server (intranet penetration / reverse tunnel)
            org.opencontainers.image.source=https://github.com/${{ github.repository }}
            org.opencontainers.image.version=${{ inputs.version }}

      - name: Build & push orbien
        uses: docker/build-push-action@v6
        with:
          context: .
          file: docker/Dockerfile.client
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.img.outputs.client_tags }}
          labels: |
            org.opencontainers.image.title=orbien
            org.opencontainers.image.description=Orbien client (intranet penetration / reverse tunnel)
            org.opencontainers.image.source=https://github.com/${{ github.repository }}
            org.opencontainers.image.version=${{ inputs.version }}

  publish:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Download CLI artifacts
        uses: actions/download-artifact@v4
        with:
          path: artifacts
          pattern: cli-*
          merge-multiple: true

      - name: Download desktop artifacts
        uses: actions/download-artifact@v4
        with:
          path: artifacts
          pattern: desktop-*
          merge-multiple: true

      - name: List artifacts
        run: find artifacts -type f | sort

      - name: Create / update GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: v${{ inputs.version }}
          name: v${{ inputs.version }}
          draft: false
          prerelease: ${{ contains(inputs.version, '-') }}
          generate_release_notes: true
          files: |
            artifacts/*.tar.gz
            artifacts/*.dmg
            artifacts/*.zip
            artifacts/*.exe
            artifacts/*.deb
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}