# Publish the multi-arch bridge image to GitHub Container Registry on a release.
#
# Trigger: a published GitHub Release (the release tag names the version), or a manual run.
# Output:  ghcr.io/mega-yfue/ha-eufy-sdk-bridge:<version> + :latest — one manifest carrying
#          linux/amd64 + linux/arm64 (node:24-alpine has no arm/v7 base).
#
# The SDK is a PUBLIC npm package (pulled by `npm ci` in the build), so no SDK checkout / build context.
# Uses the docker CLI in shell rather than the docker/* marketplace actions, because the org's Actions
# policy allows only actions owned by mega-yfue or created by GitHub — so `actions/checkout` is fine,
# but `docker/build-push-action` etc. are not. buildx is preinstalled on the runner; arm64 emulation
# comes from a `tonistiigi/binfmt` image pull (an image, not an action). Push uses the built-in
# GITHUB_TOKEN via `packages: write`.
name: Publish image to GHCR

on:
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      version:
        description: "Image version tag (e.g. 0.2.0). Defaults to package.json."
        required: false

permissions:
  contents: read
  packages: write

env:
  IMAGE: ghcr.io/mega-yfue/ha-eufy-sdk-bridge

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Resolve version (release tag must match package.json)
        id: v
        run: |
          if [ -n "${{ github.event.inputs.version }}" ]; then
            VER="${{ github.event.inputs.version }}"
          elif [ -n "${{ github.event.release.tag_name }}" ]; then
            VER="${{ github.event.release.tag_name }}"
          else
            VER="$(node -p "require('./package.json').version")"
          fi
          VER="${VER#v}"   # tolerate a leading v (v0.2.0 → 0.2.0)
          PKG="$(node -p "require('./package.json').version")"
          if [ "$VER" != "$PKG" ]; then
            echo "::error::release/input version '$VER' does not match package.json '$PKG' — bump package.json to match before releasing"
            exit 1
          fi
          echo "version=$VER" >> "$GITHUB_OUTPUT"
          echo "Publishing $IMAGE:$VER (+ :latest)"

      - name: Enable arm64 emulation (binfmt)
        run: docker run --rm --privileged tonistiigi/binfmt --install arm64

      - name: Create a buildx builder
        run: docker buildx create --use --name eufy-ci --driver docker-container

      - name: Log in to GHCR
        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin

      - name: Build and push the multi-arch manifest
        run: |
          docker buildx build \
            --platform linux/amd64,linux/arm64 \
            --tag "$IMAGE:${{ steps.v.outputs.version }}" \
            --tag "$IMAGE:latest" \
            --push \
            .

      - name: Summary
        run: |
          {
            echo "### Published \`$IMAGE:${{ steps.v.outputs.version }}\`"
            echo ""
            echo "Platforms: \`linux/amd64\`, \`linux/arm64\` · also tagged \`:latest\`"
          } >> "$GITHUB_STEP_SUMMARY"