name: Publish formal release

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      release_tag:
        description: Existing formal tag to publish, for example v2.1.5
        required: true
        default: v2.1.5
        type: string

concurrency:
  group: formal-release-${{ inputs.release_tag || github.ref_name }}
  cancel-in-progress: false

permissions:
  contents: write
  packages: write

env:
  RELEASE_TAG: ${{ inputs.release_tag || github.ref_name }}

jobs:
  test:
    name: Test Python ${{ matrix.python-version }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.9", "3.11", "3.13"]
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ env.RELEASE_TAG }}
      - uses: actions/setup-python@v7
        with:
          python-version: ${{ matrix.python-version }}
      - name: Verify formal version tag
        shell: bash
        run: test "${RELEASE_TAG}" = "v$(tr -d '\r\n' < VERSION)"
      - name: Compile Python sources
        run: python -m py_compile vpngate_manager.py vpn_utils.py proxy_server.py snapshot_utils.py
      - name: Validate installation script
        run: bash -n install.sh
      - name: Validate Docker Compose configuration
        run: docker compose -f compose.yaml config >/dev/null
      - name: Run unit tests
        run: python -m unittest discover -s tests -v

  docker-smoke:
    name: Smoke test Docker ${{ matrix.slug }}
    needs: test
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: linux/amd64
            slug: amd64
          - platform: linux/386
            slug: 386
          - platform: linux/arm64
            slug: arm64
          - platform: linux/arm/v7
            slug: armv7
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ env.RELEASE_TAG }}
      - uses: docker/setup-qemu-action@v4
      - uses: docker/setup-buildx-action@v4
      - name: Build architecture image for smoke test
        uses: docker/build-push-action@v7
        with:
          context: .
          load: true
          platforms: ${{ matrix.platform }}
          build-args: BUILD_VERSION=${{ env.RELEASE_TAG }}
          tags: aimilivpn-smoke:${{ matrix.slug }}
          cache-from: type=gha,scope=smoke-${{ matrix.slug }}
          cache-to: type=gha,mode=max,scope=smoke-${{ matrix.slug }}
      - name: Verify application imports in image
        shell: bash
        run: |
          docker run --rm --platform "${{ matrix.platform }}" \
            "aimilivpn-smoke:${{ matrix.slug }}" \
            python3 -c 'import vpngate_manager as app; print(app.APP_VERSION)'

  docker:
    name: Publish multi-architecture Docker image
    needs: docker-smoke
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ env.RELEASE_TAG }}
      - uses: docker/setup-qemu-action@v4
      - uses: docker/setup-buildx-action@v4
      - uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Resolve image tags
        id: version
        shell: bash
        run: |
          version="${RELEASE_TAG#v}"
          minor="$(printf '%s' "${version}" | cut -d. -f1,2)"
          echo "version=${version}" >> "${GITHUB_OUTPUT}"
          echo "minor=${minor}" >> "${GITHUB_OUTPUT}"
      - name: Build and publish Docker manifest
        uses: docker/build-push-action@v7
        with:
          context: .
          push: true
          platforms: linux/amd64,linux/386,linux/arm64,linux/arm/v7
          build-args: BUILD_VERSION=${{ steps.version.outputs.version }}
          tags: |
            ghcr.io/${{ github.repository }}:${{ steps.version.outputs.version }}
            ghcr.io/${{ github.repository }}:${{ steps.version.outputs.minor }}
            ghcr.io/${{ github.repository }}:latest
          cache-from: type=gha
          cache-to: type=gha,mode=max
          provenance: mode=max
          sbom: true

  release:
    name: Publish universal Python source release
    needs: docker
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ env.RELEASE_TAG }}
      - uses: actions/setup-python@v7
        with:
          python-version: "3.11"
      - name: Build universal Linux source archive
        run: python scripts/build_release_archives.py --output-dir dist
      - name: Create GitHub formal release
        env:
          GH_TOKEN: ${{ github.token }}
        shell: bash
        run: |
          title="AimiliVPN V$(tr -d '\r\n' < VERSION) 正式版"
          if gh release view "${RELEASE_TAG}" --repo "${GITHUB_REPOSITORY}" >/dev/null 2>&1; then
            gh release upload "${RELEASE_TAG}" dist/* --clobber --repo "${GITHUB_REPOSITORY}"
            gh release edit "${RELEASE_TAG}" --repo "${GITHUB_REPOSITORY}" --title "${title}" --notes-file RELEASE_NOTES.md
          else
            gh release create "${RELEASE_TAG}" dist/* --repo "${GITHUB_REPOSITORY}" --title "${title}" --notes-file RELEASE_NOTES.md --verify-tag
          fi