name: Release

# Push a tag such as v0.1.0 to build and publish the container image:
#   git tag -a v0.1.0 -m "sandbar v0.1.0" && git push origin v0.1.0
on:
  push:
    tags: ['v*']

jobs:
  image:
    runs-on: ubuntu-latest
    env:
      GOPRIVATE: git.veillax.com
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version-file: go.mod

      # Go fetches Reef straight from this server. Harmless for public repositories and
      # what makes private ones work.
      - name: Let Go fetch modules from this server
        run: git config --global url."https://x-access-token:${{ secrets.GITHUB_TOKEN }}@git.veillax.com/".insteadOf "https://git.veillax.com/"

      - name: Test
        run: |
          go vet ./...
          go test ./...

      # The Dockerfile packages these binaries, so the arm64 image needs no emulation.
      - name: Build the binaries
        run: |
          for a in amd64 arm64; do
            mkdir -p dist/bin/linux_$a
            CGO_ENABLED=0 GOOS=linux GOARCH=$a go build -trimpath \
              -ldflags "-s -w -X main.version=${GITHUB_REF_NAME}" \
              -o dist/bin/linux_$a/sandbar ./cmd/sandbar
          done

      # Optional secret REGISTRY_TOKEN (and variable REGISTRY_USER): an access token with
      # package write permission, for servers where the job token can't push.
      - name: Build and push the container image
        env:
          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN || secrets.GITHUB_TOKEN }}
          REGISTRY_USER: ${{ vars.REGISTRY_USER || github.actor }}
        run: |
          host=${GITHUB_SERVER_URL#*://}
          owner=$(echo "$GITHUB_REPOSITORY_OWNER" | tr 'A-Z' 'a-z')
          image="$host/$owner/sandbar"
          echo "$REGISTRY_TOKEN" | docker login "$host" -u "$REGISTRY_USER" --password-stdin
          # a container-driver builder can build several architectures in one go
          docker buildx create --name release --driver docker-container --use >/dev/null 2>&1 || docker buildx use release
          tags="-t $image:$GITHUB_REF_NAME"
          case "$GITHUB_REF_NAME" in
            *-*) ;;                       # pre-releases (v1.0.0-rc1) don't move :latest
            *) tags="$tags -t $image:latest" ;;
          esac
          docker buildx build --platform linux/amd64,linux/arm64 $tags --push .