package-node.yml

name: Package A · Linux Node
run-name: Package A · ${{ inputs.release_tag || inputs.version || 'manual' }}

on:
  workflow_dispatch:
    inputs:
      version:
        description: Build version override; defaults to 0.2.0-dev.0
        required: false
        default: ""
        type: string
  workflow_call:
    inputs:
      release_tag:
        description: Validated v-prefixed release tag; empty for manual packaging
        required: false
        default: ""
        type: string
      version:
        description: Non-release build version override
        required: false
        default: ""
        type: string

permissions:
  contents: read

concurrency:
  group: package-node-${{ github.ref }}-${{ inputs.release_tag || 'manual' }}
  cancel-in-progress: false

jobs:
  prepare:
    runs-on: ubuntu-22.04
    outputs:
      version: ${{ steps.context.outputs.version }}
      tag: ${{ steps.context.outputs.tag }}
      is_release: ${{ steps.context.outputs.is_release }}
      is_prerelease: ${{ steps.context.outputs.is_prerelease }}
      artifact_name: ${{ steps.context.outputs.artifact_name }}
      retention_days: ${{ steps.context.outputs.retention_days }}
      docker_artifact_name: ${{ steps.context.outputs.docker_artifact_name }}
      docker_retention_days: ${{ steps.context.outputs.docker_retention_days }}
    steps:
      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09  # v5
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
        with:
          python-version: "3.12"
      - name: Resolve validated package context
        id: context
        env:
          RELEASE_TAG: ${{ inputs.release_tag }}
          TERMFLOW_BUILD_VERSION: ${{ inputs.version || vars.TERMFLOW_BUILD_VERSION }}
        shell: bash
        run: |
          set -euo pipefail
          release_tag="$RELEASE_TAG"
          python scripts/release/prepare_version.py \
            --tag "$release_tag" --resolve-only
          if [[ -n "$release_tag" ]]; then
            artifact_name="termflow-${release_tag}-node-linux-x86_64"
            retention_days=1
            docker_artifact_name="termflow-${release_tag}-node-docker"
            docker_retention_days=1
          else
            artifact_name="termflow-node-linux-x86_64"
            retention_days=14
            docker_artifact_name="termflow-node-docker"
            docker_retention_days=14
          fi
          echo "artifact_name=$artifact_name" >> "$GITHUB_OUTPUT"
          echo "retention_days=$retention_days" >> "$GITHUB_OUTPUT"
          echo "docker_artifact_name=$docker_artifact_name" >> "$GITHUB_OUTPUT"
          echo "docker_retention_days=$docker_retention_days" >> "$GITHUB_OUTPUT"

  package:
    needs: prepare
    runs-on: ubuntu-22.04
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09  # v5
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
        with:
          python-version: "3.12"
      - name: Materialize build version
        env:
          TERMFLOW_BUILD_VERSION: ${{ needs.prepare.outputs.version }}
        run: python scripts/release/prepare_version.py
      - name: Install uv and tmux
        run: |
          python -m pip install --disable-pip-version-check uv==0.11.19
          sudo apt-get update
          sudo apt-get install --yes tmux
      - name: Sync locked workspace
        run: uv sync --frozen --all-packages
      - name: Build and verify the Node artifact
        env:
          PACKAGE_TAG: ${{ needs.prepare.outputs.tag }}
          TERMFLOW_BUILD_VERSION: ${{ needs.prepare.outputs.version }}
        run: |
          set -euo pipefail
          mkdir -p release-assets
          scripts/release/build_node_bundle.sh "$PACKAGE_TAG" release-assets
          uv run --frozen python scripts/release/render_node_installer.py \
            "$PACKAGE_TAG" release-assets/install-termflow-node.sh \
            --repository "$GITHUB_REPOSITORY"
          (cd release-assets && sha256sum termflow-node-linux-x86_64.tar.gz > SHA256SUMS)
          scripts/release/verify_node_bundle.sh "$PACKAGE_TAG"
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
        with:
          name: ${{ needs.prepare.outputs.artifact_name }}
          path: |
            release-assets/termflow-node-linux-x86_64.tar.gz
            release-assets/install-termflow-node.sh
            release-assets/SHA256SUMS
          if-no-files-found: error
          retention-days: ${{ fromJSON(needs.prepare.outputs.retention_days) }}
          compression-level: 0

  package-docker:
    needs: prepare
    runs-on: ubuntu-22.04
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09  # v5
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
        with:
          python-version: "3.12"
      - name: Materialize build version
        env:
          TERMFLOW_BUILD_VERSION: ${{ needs.prepare.outputs.version }}
        run: python scripts/release/prepare_version.py
      - name: Build, verify, archive, and reload the node image
        env:
          LOCAL_IMAGE: termflow-node:package-${{ github.run_id }}-${{ github.run_attempt }}
        run: |
          set -euo pipefail
          mkdir -p release-assets
          scripts/build-node-image.sh "$LOCAL_IMAGE"
          scripts/verify-node-image.sh "$LOCAL_IMAGE"
          scripts/release/archive_node_image.sh \
            "$LOCAL_IMAGE" release-assets/termflow-node.tar
          scripts/verify-node-image.sh "$LOCAL_IMAGE"
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
        with:
          name: ${{ needs.prepare.outputs.docker_artifact_name }}
          path: release-assets/termflow-node.tar
          if-no-files-found: error
          retention-days: ${{ fromJSON(needs.prepare.outputs.docker_retention_days) }}
          compression-level: 0

  publish:
    needs: [prepare, package, package-docker]
    if: ${{ needs.prepare.outputs.is_release == 'true' }}
    runs-on: ubuntu-22.04
    timeout-minutes: 45
    permissions:
      contents: read
      packages: write
      id-token: write
    steps:
      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09  # v5
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
        with:
          python-version: "3.12"
      - name: Materialize build version
        env:
          TERMFLOW_BUILD_VERSION: ${{ needs.prepare.outputs.version }}
        run: python scripts/release/prepare_version.py
      - uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1  # v4
      - uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003  # v4
      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f  # v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Push the validated multi-architecture node image
        id: push
        env:
          RELEASE_TAG: ${{ needs.prepare.outputs.tag }}
          VERSION: ${{ needs.prepare.outputs.version }}
          IS_PRERELEASE: ${{ needs.prepare.outputs.is_prerelease }}
        shell: bash
        run: |
          set -euo pipefail
          owner="${GITHUB_REPOSITORY_OWNER,,}"
          image="ghcr.io/${owner}/termflow-node"
          image_tag="${RELEASE_TAG//+/_}"
          tags=(
            --tag "${image}:${image_tag}"
            --tag "${image}:sha-${GITHUB_SHA}"
          )
          if [[ "$IS_PRERELEASE" == "false" ]]; then
            tags+=(--tag "${image}:latest")
          fi
          docker buildx build --platform linux/amd64,linux/arm64 --push \
            --provenance mode=max \
            --attest type=sbom \
            --label "org.opencontainers.image.source=https://github.com/${GITHUB_REPOSITORY}" \
            --label "org.opencontainers.image.version=${VERSION}" \
            --label "org.opencontainers.image.revision=${GITHUB_SHA}" \
            "${tags[@]}" \
            -f deploy/Dockerfile.node .
          digest="$(docker buildx imagetools inspect \
            "ghcr.io/${owner}/termflow-node:${image_tag}" \
            --format '{{.Manifest.Digest}}')"
          echo "digest=${digest}" >> "$GITHUB_OUTPUT"
      - uses: sigstore/cosign-installer@7e8b541eb2e61bf99390e1afd4be13a184e9ebc5  # v3.10.1
      - name: Sign the published image keylessly
        if: ${{ steps.push.outputs.digest != '' }}
        env:
          DIGEST: ${{ steps.push.outputs.digest }}
        shell: bash
        run: |
          set -euo pipefail
          owner="${GITHUB_REPOSITORY_OWNER,,}"
          cosign sign --yes "ghcr.io/${owner}/termflow-node@${DIGEST}"