name: release

on:
  push:
    tags:
      - "v*.*.*"

jobs:
  verify-publish:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Verify release
        run: ./scripts/codex_verify.sh
      - name: Build immutable image
        env:
          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
        run: |
          set -euo pipefail
          version="${GITHUB_REF_NAME#v}"
          registry="gitea.itworx.tech"
          image="${registry}/jens/vacatureradar:${version}"
          printf '%s' "$REGISTRY_TOKEN" | docker login "$registry" --username "$REGISTRY_USER" --password-stdin
          docker build --file Dockerfile.unraid \
            --build-arg "VCS_REF=${GITHUB_SHA}" \
            --build-arg "APP_VERSION=${version}" \
            --tag "$image" .
          docker push "$image"
          docker image inspect "$image" --format '{{index .RepoDigests 0}}' > image-digest.txt
          docker sbom "$image" --format spdx-json > sbom.spdx.json
          cat > RELEASE_NOTES.md <<EOF
          # VacatureRadar ${version}

          Immutable release image built from commit ${GITHUB_SHA}.
          The accompanying digest, SPDX SBOM and checksums are release evidence.
          EOF
          sha256sum image-digest.txt sbom.spdx.json RELEASE_NOTES.md > SHA256SUMS
      - name: Publish release evidence
        uses: actions/upload-artifact@v4
        with:
          name: release-evidence-${{ github.ref_name }}
          path: |
            image-digest.txt
            sbom.spdx.json
            SHA256SUMS
            RELEASE_NOTES.md