windmill/.github/workflows/publish_extra.yml

env:
  REGISTRY: ghcr.io
  ECR_REGISTRY: 976079455550.dkr.ecr.us-east-1.amazonaws.com
  IMAGE_NAME: ${{ github.repository }}-extra

name: Publish windmill-extra
on:
  push:
    tags:
      - "v*"
  workflow_dispatch:

permissions: write-all

jobs:
  sleep:
    runs-on: ubicloud
    steps:
      - name: Sleep for 900 seconds waiting for pypi to update index
        if: startsWith(github.ref, 'refs/tags/v')
        run: sleep 900
        shell: bash

  # Build and test the image before publishing
  test_extra:
    needs: [sleep]
    runs-on: ubicloud-standard-8
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      # Matches the Node major DockerfileExtra installs. The pin is load-bearing:
      # glob arguments to `node --test` need Node >= 21.
      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: 22

      - name: Run multiplayer unit tests
        working-directory: multiplayer
        run: |
          npm ci --omit=dev
          npm test

      # Runs the real entrypoint-extra.sh with stub services, so the supervision
      # behaviour is checked without building the image first.
      - name: Run entrypoint supervision tests
        run: bash docker/test_entrypoint_extra.sh

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build test image
        uses: docker/build-push-action@v7
        with:
          context: .
          file: ./docker/DockerfileExtra
          load: true
          tags: windmill-extra:test
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Start container
        run: |
          docker run -d --name windmill-extra-test \
            -p 3001:3001 -p 3002:3002 -p 3003:3003 \
            -e ENABLE_LSP=true \
            -e ENABLE_MULTIPLAYER=true \
            -e ENABLE_DEBUGGER=true \
            -e DEBUGGER_PORT=3003 \
            -e REQUIRE_SIGNED_DEBUG_REQUESTS=false \
            windmill-extra:test

          # Wait for container to start
          echo "Waiting for container to initialize..."
          sleep 10

          # Show container logs for debugging
          docker logs windmill-extra-test

      - name: Run integration tests
        run: |
          bun run docker/test_windmill_extra.ts

      - name: Show container logs on failure
        if: failure()
        run: |
          echo "=== Container logs ==="
          docker logs windmill-extra-test

      - name: Cleanup
        if: always()
        run: |
          docker stop windmill-extra-test || true
          docker rm windmill-extra-test || true

  publish_extra:
    needs: [sleep, test_extra]
    # a tag-targeted dispatch would republish the release tags unsigned,
    # un-verifying the release; to republish a release, re-push its tag
    if: github.event_name == 'push' || !startsWith(github.ref, 'refs/tags/')
    runs-on: ubicloud-standard-8
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: depot/setup-action@v1

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: |
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=ref,event=branch
            type=ref,event=pr
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}

      - name: Login to registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push publicly
        id: docker_build
        uses: depot/build-push-action@v1
        with:
          context: .
          file: ./docker/DockerfileExtra
          platforms: linux/amd64,linux/arm64
          push: true
          sbom: ${{ startsWith(github.ref, 'refs/tags/v') && github.event_name == 'push' }}
          tags: |
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
            ${{ steps.meta.outputs.tags }}
          labels: |
            ${{ steps.meta.outputs.labels }}
            org.opencontainers.image.licenses=AGPLv3

      - name: Sign and attest release image
        if: startsWith(github.ref, 'refs/tags/v') && github.event_name == 'push'
        uses: ./.github/actions/sign-attest-image
        with:
          image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          digest: ${{ steps.docker_build.outputs.digest }}