---
name: release-nightly

on:
  workflow_dispatch:
  push:
    branches:
      - 'main'
    tags:
      - '*'

env:
  DOCKER_ORG: gitea
  DOCKER_LATEST: nightly

jobs:
  goreleaser:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          fetch-depth: 0
      # Custom publishers (the R2 mirror below) run as the very last
      # step of goreleaser's publish pipeline, after the Gitea release
      # has already been created and every artifact already uploaded
      # to S3. Fail here instead, before anything is built or
      # published, if the R2 secrets are missing.
      - name: check R2 configuration
        run: sh scripts/upload-r2.sh --check-config
        env:
          R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
          R2_BUCKET: ${{ secrets.R2_BUCKET }}
          R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
          R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
        with:
          go-version-file: "go.mod"
      - name: goreleaser
        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7
        with:
          distribution: goreleaser-pro
          args: release --nightly
        env:
          GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
          AWS_REGION: ${{ secrets.AWS_REGION }}
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          S3_REGION: ${{ secrets.AWS_REGION }}
          S3_BUCKET: ${{ secrets.AWS_BUCKET }}
          R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
          R2_BUCKET: ${{ secrets.R2_BUCKET }}
          R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
          R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
          GORELEASER_FORCE_TOKEN: "gitea"
          GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  release-image:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        variant:
          # The basic image is built from source and can target any arch the
          # toolchain supports. The dind variants are limited to the arches the
          # docker:dind base image publishes.
          - target: basic
            tag_suffix: ""
            platforms: linux/amd64,linux/arm64,linux/riscv64,linux/s390x
          - target: dind
            tag_suffix: "-dind"
            platforms: linux/amd64,linux/arm64
          - target: dind-rootless
            tag_suffix: "-dind-rootless"
            platforms: linux/amd64,linux/arm64

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          fetch-depth: 0 # all history for all branches and tags

      - name: Set up QEMU
        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4

      - name: Set up Docker BuildX
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4

      - name: Login to DockerHub
        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Echo the tag
        run: echo "${{ env.DOCKER_ORG }}/runner:nightly${{ matrix.variant.tag_suffix }}"

      - name: Get Meta
        id: meta
        run: |
          echo REPO_VERSION=$(git describe --tags --always | sed 's/-/+/' | sed 's/^v//') >> $GITHUB_OUTPUT

      - name: Build and push
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
        with:
          context: .
          file: ./Dockerfile
          target: ${{ matrix.variant.target }}
          platforms: ${{ matrix.variant.platforms }}
          push: true
          tags: |
            ${{ env.DOCKER_ORG }}/runner:nightly${{ matrix.variant.tag_suffix }}
          build-args: |
            VERSION=${{ steps.meta.outputs.REPO_VERSION }}