name: Publish Artifacts
description: 'Publish artifacts to Github Release'
inputs:
  token:
    description: 'Token to use for publishing.'
    required: true
  homebrew-gh-secret:
    description: 'SSH private key used as a GitHub deploy key for publishing to homebrew-tap.'
    required: true
  dry-run:
    description: 'Is this a dry run. If so no package will be published.'
    required: false
    default: 'true'
  snapshot:
    description: 'Create a snapshot release by passing --snapshot to goreleaser. See also `goreleaser release --help'
    default: 'false'
  skip:
    description: 'Set of steps for goreleaser to skip. See also `goreleaser --skip`'
  tag:
    description: 'Tag to upload artifacts to.'
    required: true
  ghcr_token:
    description: 'Token to log into ghcr.io'
    required: true

outputs:
  checksum_file:
    description: path to the sha256 checksums file generated by goreleaser
    value: ${{ steps.binary.outputs.checksum_file }}
  images_and_digests:
    description: built docker image names and digests in JSON format
    value: ${{ steps.image.outputs.images_and_digests }}

runs:
  using: composite
  steps:
    - name: Set up QEMU
      uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
    - name: Setup Docker Buildx
      uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
      with:
        platforms: linux/amd64,linux/arm64/v8,linux/arm/v7,linux/386
    - name: Set up goreleaser
      # Note: that we're unable to use the normal goreleaser actions and have to use this docker image.
      # This is because the dev server piece of the CLI uses SQLite which requires CGO and cross compilation.
      # We're using the goreleaser-cross image to facilitate this. See also: https://github.com/goreleaser/goreleaser-cross
      shell: bash
      run: |
        docker login --username $DOCKER_HUB_USERNAME --password $DOCKER_HUB_TOKEN
        echo ${{ inputs.ghcr_token }} | docker login ghcr.io -u ${{ github.actor }} --password-stdin
        CONTAINER_ID="$(
          docker run --detach \
            --volume "$PWD:$PWD" \
            --volume /var/run/docker.sock:/var/run/docker.sock \
            --entrypoint tail \
            ghcr.io/launchdarkly/goreleaser-cross@sha256:3406461901b9c5c6f1f7ef7715dd02b150909f2704ea3df6e05a1c9e102d98e0  \
              -f /dev/null
        )"
        docker exec --workdir "$PWD" --tty "$CONTAINER_ID" docker login --username "$DOCKER_HUB_USERNAME" --password "$DOCKER_HUB_TOKEN"
        echo "CONTAINER_ID=$CONTAINER_ID" >> "$GITHUB_ENV"
    - name: Run Goreleaser
      shell: bash
      run: docker exec
        --env GITHUB_TOKEN
        --env HOMEBREW_DEPLOY_KEY
        --workdir "$PWD"
        --tty
        "$CONTAINER_ID"
        goreleaser release 
            ${{ inputs.dry-run == 'true' && '--skip=publish' || '' }}
            ${{ inputs.snapshot == 'true' && '--snapshot' || '' }}
            ${{ inputs.skip == '' && '' || format('--skip={0}', inputs.skip) }}
            --config .goreleaser.yaml
      env:
        GITHUB_TOKEN: ${{ inputs.token }}
        HOMEBREW_DEPLOY_KEY: ${{ inputs.homebrew-gh-secret }}
    - name: Upload assets
      uses: actions/upload-artifact@v4
      with:
        name: ldcli
        path: dist/*
    - name: Generate binary checksum file path
      id: binary
      shell: bash
      run: |
        # Extract path to checksums file generated by goreleaser from dist/artifacts.json
        set -euo pipefail

        checksum_file=$(jq -r '.[] | select (.type=="Checksum") | .path' dist/artifacts.json)
        echo "checksum_file=$checksum_file" >> "$GITHUB_OUTPUT"
    - name: Output image and digest
      id: image
      shell: bash
      run: |
        # Extract image names and digests from goreleaser's dist/artifacts.json
        set -euo pipefail

        echo "images_and_digests=$(jq -c '. | map(select (.type=="Docker Manifest") | .image=(.path | split(":")[0]) | .digest=(.extra | .Digest) | {image, digest})' dist/artifacts.json)" >> "$GITHUB_OUTPUT"
    - name: Upload Release Artifacts
      if: ${{ inputs.dry-run != 'true' }}
      shell: bash
      env:
        GITHUB_TOKEN: ${{ inputs.token }}
      run: |
        # nullglob lets the *.zip (and any other format we don't currently
        # produce) expand to nothing instead of being passed literally to
        # gh release upload, which would fail with "no matches found".
        set -euo pipefail
        shopt -s nullglob
        files=(./dist/*.tar.gz ./dist/*.zip ./dist/*.txt)
        if [ ${#files[@]} -eq 0 ]; then
          echo "No artifacts found in ./dist to upload" >&2
          exit 1
        fi
        gh release upload "${{ inputs.tag }}" "${files[@]}" --clobber