name: release

on:
  push:
    tags:
      - "v*.*.*"

jobs:
  verify-publish:
    runs-on: linux-validation
    steps:
      - uses: actions/checkout@v4
      - name: Install pinned uv
        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
        with:
          version: "0.11.12"
          python-version: "3.13"
      - name: Install verification browser
        run: |
          uv sync --extra browser
          uv run playwright install --with-deps chromium
      - name: Verify release
        run: bash ./scripts/codex_verify.sh
      - name: Build immutable image
        env:
          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
        run: |
          set -euo pipefail
          version="${GITHUB_REF_NAME#v}"
          registry="gitea.itworx.tech"
          image="${registry}/jens/vacatureradar:${version}"
          printf '%s' "$REGISTRY_TOKEN" | docker login "$registry" --username "$REGISTRY_USER" --password-stdin
          docker build --file Dockerfile.unraid \
            --build-arg "VCS_REF=${GITHUB_SHA}" \
            --build-arg "APP_VERSION=${version}" \
            --tag "$image" .
          docker push "$image"
          docker image inspect "$image" --format '{{index .RepoDigests 0}}' > image-digest.txt
          docker run --rm \
            -v /var/run/docker.sock:/var/run/docker.sock \
            anchore/syft:v1.33.0 \
            "docker:$image" -o spdx-json > sbom.spdx.json
          cat > RELEASE_NOTES.md <<EOF
          # VacatureRadar ${version}

          Immutable release image built from commit ${GITHUB_SHA}.
          The accompanying digest, SPDX SBOM and checksums are release evidence.
          EOF
          sha256sum image-digest.txt sbom.spdx.json RELEASE_NOTES.md > SHA256SUMS
      - name: Publish release evidence
        uses: actions/upload-artifact@v3
        with:
          name: release-evidence-${{ github.ref_name }}
          path: |
            image-digest.txt
            sbom.spdx.json
            SHA256SUMS
            RELEASE_NOTES.md