name: Release

on:
  push:
    tags:
      - 'v*.*.*'
  workflow_dispatch:
    inputs:
      version:
        description: 'Version to publish (e.g. 0.1.22). Leave blank to derive from tag.'
        required: false
        type: string
      npm_only:
        description: 'Skip Docker + GitHub Release (npm only — for testing)'
        required: false
        type: boolean
        default: false

permissions:
  contents: write      # create GitHub Release + attach assets
  packages: write      # push Docker images to ghcr.io
  id-token: write      # npm provenance

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  # ---------------------------------------------------------------------------
  # npm — bump every publishable @infernetprotocol/* workspace package to the
  # tag's version and publish to npmjs.org with provenance. Internal
  # workspace:* deps are rewritten to the concrete version by `pnpm publish`.
  # ---------------------------------------------------------------------------
  npm:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.version.outputs.version }}
    steps:
      - uses: actions/checkout@v5

      - uses: pnpm/action-setup@v4
        with:
          version: 10.6.5

      - uses: actions/setup-node@v5
        with:
          node-version: lts/*
          cache: pnpm
          registry-url: https://registry.npmjs.org

      - name: Resolve version
        id: version
        run: |
          if [ -n "${{ inputs.version }}" ]; then
            VERSION="${{ inputs.version }}"
          else
            VERSION="${GITHUB_REF_NAME#v}"
          fi
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "Releasing version $VERSION"

      - run: pnpm install --frozen-lockfile

      - name: Stamp workspace versions
        # Use `npm pkg set` (a pure package.json field edit) rather than
        # `npm version`. Newer npm makes `npm version` reconcile the dep tree,
        # which throws EUNSUPPORTEDPROTOCOL on our `workspace:*` deps in a pnpm
        # monorepo. `npm pkg set` just rewrites the version field.
        run: |
          pnpm -r --workspace-concurrency=1 \
            exec npm pkg set version="${{ steps.version.outputs.version }}"

      - name: Publish public @infernetprotocol/* packages
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
          NPM_CONFIG_PROVENANCE: true
        run: |
          # Public surface only. The 7 internal packages (api-schema, db,
          # inference, logger, nim-adapter, payments, training) are marked
          # "private": true in their package.json so pnpm publish skips
          # them by default; they're consumed via workspace:* inside the
          # monorepo and never need to be on npm.
          pnpm publish \
            --filter "@infernetprotocol/cli" \
            --filter "@infernetprotocol/sdk" \
            --filter "@infernetprotocol/auth" \
            --filter "@infernetprotocol/config" \
            --filter "@infernetprotocol/deploy-providers" \
            --filter "@infernetprotocol/engine" \
            --filter "@infernetprotocol/gpu" \
            --access public \
            --no-git-checks \
            --tag latest

  # ---------------------------------------------------------------------------
  # Docker — build ghcr.io/<owner>/infernet-provider:<version> + :latest
  # directly from the git checkout (no npm registry needed). Multi-arch.
  # ---------------------------------------------------------------------------
  docker:
    runs-on: ubuntu-latest
    needs: npm
    if: ${{ !inputs.npm_only }}
    outputs:
      version: ${{ steps.version.outputs.version }}
    steps:
      - uses: actions/checkout@v5

      - name: Extract version from tag
        id: version
        run: |
          if [ -n "${{ inputs.version }}" ]; then
            VERSION="${{ inputs.version }}"
          else
            VERSION="${GITHUB_REF_NAME#v}"
          fi
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - name: Lowercase repository owner for Docker registry
        # GHCR / OCI tags must be lowercase, but npm sigstore needs the
        # canonical mixed-case "InfernetProtocol" — they're at odds, so
        # lowercase here just for the Docker tags.
        id: owner
        run: echo "lc=$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')" >> "$GITHUB_OUTPUT"

      - uses: docker/setup-qemu-action@v3
      - uses: docker/setup-buildx-action@v3

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push provider image
        uses: docker/build-push-action@v5
        with:
          context: .
          file: tooling/docker/provider/Dockerfile
          platforms: linux/amd64,linux/arm64
          push: true
          tags: |
            ghcr.io/${{ steps.owner.outputs.lc }}/infernet-provider:${{ steps.version.outputs.version }}
            ghcr.io/${{ steps.owner.outputs.lc }}/infernet-provider:latest
          labels: |
            org.opencontainers.image.source=https://github.com/${{ github.repository }}
            org.opencontainers.image.revision=${{ github.sha }}
            org.opencontainers.image.version=${{ steps.version.outputs.version }}

  # ---------------------------------------------------------------------------
  # GitHub Release — capture the version + Docker pull command as release notes.
  # ---------------------------------------------------------------------------
  release:
    runs-on: ubuntu-latest
    needs: docker
    if: ${{ !inputs.npm_only }}
    steps:
      - uses: actions/checkout@v5

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: v${{ needs.docker.outputs.version }}
          name: Infernet v${{ needs.docker.outputs.version }}
          body: |
            ## Infernet v${{ needs.docker.outputs.version }}

            ### Run a provider node

            ```bash
            docker run --rm -it \
              --gpus all \
              -p 46337:46337 \
              -e SUPABASE_URL=https://<your-project>.supabase.co \
              -e SUPABASE_SERVICE_ROLE_KEY=<your-service-role-key> \
              -e INFERNET_NODE_NAME=<your-node-name> \
              ghcr.io/${{ github.repository_owner }}/infernet-provider:${{ needs.docker.outputs.version }}
            ```

            Multi-arch: `linux/amd64` + `linux/arm64`.

            ### Platforms coming soon

            npm packages (`@infernetprotocol/*`) and Homebrew install (`brew install infernet`) are on the roadmap but not shipped with this release. For now, Docker is the supported install path.