name: release images

on:
  release:
    types: [published]
  workflow_call:
    inputs:
      release_tag:
        description: Immutable release tag created by Release Please
        required: true
        type: string
  workflow_dispatch:
    inputs:
      release_tag:
        description: Existing immutable release tag to publish
        required: true
        type: string

permissions:
  contents: read
  packages: write

jobs:
  publish:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v6

      - name: Install Nix
        uses: DeterminateSystems/determinate-nix-action@v3
        with:
          # Without devenv's own binary cache, `nix profile add devenv` builds
          # it from source — hundreds of Rust crates — and the job dies in the
          # install step before it ever reaches the image build. That is why
          # no release has published images since the workflow was written.
          extra-conf: |
            extra-substituters = https://devenv.cachix.org
            extra-trusted-public-keys = devenv.cachix.org-1:w1cLUi8dv3hnoSPGAuibQv+f9TZLr6cv/Hm9XgU50cw=

      - name: Restore and save Nix store
        uses: nix-community/cache-nix-action@v7
        with:
          primary-key: nix-${{ runner.os }}-${{ hashFiles('flake.lock', 'flake.nix', 'devenv.lock', 'devenv.nix', 'devenv.yaml', 'code/operator/go.sum') }}
          restore-prefixes-first-match: nix-${{ runner.os }}-
          gc-max-store-size-linux: 2G

      - name: Install devenv
        run: nix profile add github:cachix/devenv/ea3d94ac9d6bf6a1313773170122ca4e2ef5a0be

      - name: Authenticate to GHCR
        env:
          GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          export DOCKER_CONFIG="$RUNNER_TEMP/docker"
          mkdir -p "$DOCKER_CONFIG"
          docker login \
            --username "${GITHUB_ACTOR}" \
            --password-stdin ghcr.io <<<"$GHCR_TOKEN"

      # Controller only. This repository publishes no agent runtime image.
      # Per issue #13 the runtime is the published Outfitter container, which a
      # consumer runs directly or extends in its own <org>/.agents repository.
      # `containers.agent` still exists for the local dev cluster — it is simply
      # never released, so nothing downstream can pin it.
      - name: Publish immutable controller image
        env:
          RELEASE_TAG: ${{ inputs.release_tag || github.event.release.tag_name }}
        run: |
          set -euo pipefail
          authfile="$RUNNER_TEMP/docker/config.json"
          sha_tag="sha-${GITHUB_SHA}"
          for image in operator; do
            case "$image" in
              operator) repository=agent-operator ;;
            esac
            for tag in "$RELEASE_TAG" "$sha_tag"; do
              devenv container copy --no-tui \
                --copy-args="--authfile=$authfile" \
                --option "containers.$image.name:string" "$repository" \
                --option "containers.$image.version:string" "$tag" \
                --registry "docker://ghcr.io/ai-outfitter/" \
                "$image"
            done
          done