name: Publish Images

on:
  push:
    branches:
      - dev
      - release
      - release/**
      - main

permissions:
  contents: read

concurrency:
  group: publish-images-${{ github.ref }}
  cancel-in-progress: true

jobs:
  publish:
    runs-on: ubuntu-latest
    env:
      REMOTE_BASE_DIR: /opt/ctms-build
      SSH_KEY_PATH: /tmp/tcloud_ci_key
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Prepare remote path metadata
        id: meta
        shell: bash
        run: |
          echo "repo_name=${GITHUB_REPOSITORY#*/}" >> "$GITHUB_OUTPUT"
          echo "branch_name=${GITHUB_REF_NAME}" >> "$GITHUB_OUTPUT"
          echo "short_sha=${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT"

      - name: Install SSH key
        shell: bash
        run: |
          printf '%s\n' '${{ secrets.TCLOUD_SSH_KEY }}' > "${{ env.SSH_KEY_PATH }}"
          chmod 600 "${{ env.SSH_KEY_PATH }}"

      - name: Sync repository to Tencent Cloud host
        shell: bash
        env:
          TCLOUD_HOST: ${{ secrets.TCLOUD_HOST }}
          TCLOUD_PORT: ${{ secrets.TCLOUD_PORT }}
          TCLOUD_USER: ${{ secrets.TCLOUD_USER }}
          REMOTE_REPO_DIR: ${{ env.REMOTE_BASE_DIR }}/${{ steps.meta.outputs.repo_name }}
        run: |
          ssh -i "${{ env.SSH_KEY_PATH }}" -p "${TCLOUD_PORT}" -o StrictHostKeyChecking=no "${TCLOUD_USER}@${TCLOUD_HOST}" \
            "mkdir -p '${REMOTE_REPO_DIR}' && find '${REMOTE_REPO_DIR}' -mindepth 1 -maxdepth 1 -exec rm -rf {} +"
          tar --exclude=.git -cf - . | \
            ssh -i "${{ env.SSH_KEY_PATH }}" -p "${TCLOUD_PORT}" -o StrictHostKeyChecking=no "${TCLOUD_USER}@${TCLOUD_HOST}" \
            "tar -xf - -C '${REMOTE_REPO_DIR}'"

      - name: Build and push images on Tencent Cloud host
        shell: bash
        env:
          TCLOUD_HOST: ${{ secrets.TCLOUD_HOST }}
          TCLOUD_PORT: ${{ secrets.TCLOUD_PORT }}
          TCLOUD_USER: ${{ secrets.TCLOUD_USER }}
          BRANCH_NAME: ${{ steps.meta.outputs.branch_name }}
          COMMIT_SHA: ${{ github.sha }}
          REGISTRY_HOST: ${{ secrets.REGISTRY_HOST }}
          REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
          REMOTE_REPO_DIR: ${{ env.REMOTE_BASE_DIR }}/${{ steps.meta.outputs.repo_name }}
        run: |
          BRANCH_NAME_B64="$(printf '%s' "${BRANCH_NAME}" | base64)"
          COMMIT_SHA_B64="$(printf '%s' "${COMMIT_SHA}" | base64)"
          REGISTRY_HOST_B64="$(printf '%s' "${REGISTRY_HOST}" | base64)"
          REGISTRY_USERNAME_B64="$(printf '%s' "${REGISTRY_USERNAME}" | base64)"
          REGISTRY_PASSWORD_B64="$(printf '%s' "${REGISTRY_PASSWORD}" | base64)"
          ssh -i "${{ env.SSH_KEY_PATH }}" -p "${TCLOUD_PORT}" -o StrictHostKeyChecking=no "${TCLOUD_USER}@${TCLOUD_HOST}" "
            cd '${REMOTE_REPO_DIR}'
            chmod +x scripts/build-and-push-registry.sh
            export BRANCH_NAME=\$(printf '%s' '${BRANCH_NAME_B64}' | base64 -d)
            export COMMIT_SHA=\$(printf '%s' '${COMMIT_SHA_B64}' | base64 -d)
            export REGISTRY_HOST=\$(printf '%s' '${REGISTRY_HOST_B64}' | base64 -d)
            export REGISTRY_USERNAME=\$(printf '%s' '${REGISTRY_USERNAME_B64}' | base64 -d)
            export REGISTRY_PASSWORD=\$(printf '%s' '${REGISTRY_PASSWORD_B64}' | base64 -d)
            ./scripts/build-and-push-registry.sh
          "