name: Publish Release Image

# Promote the scanned dev image to the release tag (and latest); never rebuilds.
on:
  release:
    types: [published]

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  promote:
    runs-on: running-man
    env:
      REGISTRY: git.sysmd.uk
      IMAGE: git.sysmd.uk/mdaleo404/kovi
    steps:
      - name: Login to registry
        run: |
          echo "$REGISTRY_TOKEN" | docker login "${REGISTRY}" -u "$REGISTRY_USER" --password-stdin
        env:
          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}

      - name: Setup Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Resolve tags
        env:
          EVENT_TAG: ${{ github.event.release.tag_name }}
          PRERELEASE: ${{ github.event.release.prerelease }}
        run: |
          set -euo pipefail
          TAG="${EVENT_TAG:?release tag missing}"
          {
            echo "TAG=${TAG}"
            echo "SOURCE_REF=${IMAGE}:dev"
          } >> "$GITHUB_ENV"
          if [ "${PRERELEASE:-}" != "true" ]; then
            echo "PUSH_LATEST=1" >> "$GITHUB_ENV"
          fi
          echo "Promoting ${IMAGE}:dev -> ${IMAGE}:${TAG}"

      - name: Promote image
        run: |
          set -euo pipefail
          TAGS=(-t "${IMAGE}:${TAG}")
          if [ "${PUSH_LATEST:-}" = "1" ]; then TAGS+=(-t "${IMAGE}:latest"); fi
          docker buildx imagetools create "${TAGS[@]}" "${SOURCE_REF}"