name: Workshop

on:
  pull_request:
    paths:
      - ".github/workflows/workshop.yml"
      - "apps/workshop/**"
      - "apps/docs/**"
      - "packages/common/**"
      - "packages/core/**"
      - "packages/custom-widgets/**"
      - "packages/definitions/**"
      - "packages/db/**"
      - "packages/server-settings/**"
      - "packages/settings/**"
      - "packages/translation/**"
      - "packages/ui/**"
      - "packages/validation/**"
      - "packages/workshop/**"
      - "tooling/typescript/**"
      - "patches/**"
      - "package.json"
      - "pnpm-lock.yaml"
      - "pnpm-workspace.yaml"
      - "turbo.json"
      - ".npmrc"
  push:
    branches: [dev, v2, release/v2, main]
    paths:
      - ".github/workflows/workshop.yml"
      - "apps/workshop/**"
      - "apps/docs/**"
      - "packages/common/**"
      - "packages/core/**"
      - "packages/custom-widgets/**"
      - "packages/definitions/**"
      - "packages/db/**"
      - "packages/server-settings/**"
      - "packages/settings/**"
      - "packages/translation/**"
      - "packages/ui/**"
      - "packages/validation/**"
      - "packages/workshop/**"
      - "tooling/typescript/**"
      - "patches/**"
      - "package.json"
      - "pnpm-lock.yaml"
      - "pnpm-workspace.yaml"
      - "turbo.json"
      - ".npmrc"

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ (github.ref_name == 'v2' || github.ref_name == 'release/v2') && 'v2-preview' || github.ref }}
  cancel-in-progress: true

jobs:
  production-smoke:
    if: github.event_name == 'pull_request'
    name: Production image smoke (${{ matrix.arch }})
    strategy:
      fail-fast: false
      matrix:
        include:
          - arch: amd64
            runner: ubuntu-24.04
          - arch: arm64
            runner: ubuntu-24.04-arm
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v6
        with:
          node-version: 24.18.0
      - name: Build and exercise the combined production image
        run: sh apps/workshop/test-image.sh

  validate:
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v7
      - run: docker compose --env-file apps/workshop/.env.staging.example -f apps/workshop/docker-compose.staging.yml config --quiet

  publish-amd64:
    if: github.event_name == 'push' && (github.ref_name == 'v2' || github.ref_name == 'release/v2' || github.ref_name == 'main')
    needs: validate
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    permissions:
      contents: read
      packages: write
    outputs:
      digest: ${{ steps.build.outputs.digest }}
    steps:
      - uses: actions/checkout@v7
      - uses: docker/setup-buildx-action@v4
      - uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: docker/build-push-action@v7
        id: build
        with:
          context: .
          file: apps/workshop/Dockerfile
          target: production
          platforms: linux/amd64
          outputs: type=image,"name=ghcr.io/homarr-labs/workshop",push-by-digest=true,name-canonical=true,push=true
          cache-from: type=gha,scope=workshop-linux-amd64
          cache-to: type=gha,scope=workshop-linux-amd64,mode=max

  publish-arm64:
    if: github.event_name == 'push' && (github.ref_name == 'v2' || github.ref_name == 'release/v2' || github.ref_name == 'main')
    needs: validate
    runs-on: ubuntu-24.04-arm
    timeout-minutes: 20
    permissions:
      contents: read
      packages: write
    outputs:
      digest: ${{ steps.build.outputs.digest }}
    steps:
      - uses: actions/checkout@v7
      - uses: docker/setup-buildx-action@v4
      - uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: docker/build-push-action@v7
        id: build
        with:
          context: .
          file: apps/workshop/Dockerfile
          target: production
          platforms: linux/arm64
          outputs: type=image,"name=ghcr.io/homarr-labs/workshop",push-by-digest=true,name-canonical=true,push=true
          cache-from: type=gha,scope=workshop-linux-arm64
          cache-to: type=gha,scope=workshop-linux-arm64,mode=max

  publish:
    if: github.event_name == 'push' && (github.ref_name == 'v2' || github.ref_name == 'release/v2' || github.ref_name == 'main')
    needs: [publish-amd64, publish-arm64]
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    permissions:
      contents: read
      packages: write
    env:
      WORKSHOP_IMAGE: ghcr.io/homarr-labs/workshop
    steps:
      - uses: docker/setup-buildx-action@v4
      - uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Verify branch head before publication
        uses: actions/github-script@v8
        with:
          script: |
            const branchName = context.ref.replace("refs/heads/", "");
            const { data: branch } = await github.rest.repos.getBranch({
              owner: context.repo.owner,
              repo: context.repo.repo,
              branch: branchName,
            });
            if (branch.commit.sha !== context.sha) {
              core.setFailed(`Branch ${branchName} moved from ${context.sha} to ${branch.commit.sha}.`);
            }
      - name: Publish multi-platform image
        env:
          AMD64_DIGEST: ${{ needs.publish-amd64.outputs.digest }}
          ARM64_DIGEST: ${{ needs.publish-arm64.outputs.digest }}
        run: |
          tags=(-t "${WORKSHOP_IMAGE}:sha-${GITHUB_SHA}")
          if [[ "${GITHUB_REF_NAME}" == "v2" || "${GITHUB_REF_NAME}" == "release/v2" ]]; then
            tags+=(-t "${WORKSHOP_IMAGE}:v2")
          fi
          if [[ "${GITHUB_REF_NAME}" == "main" ]]; then
            tags+=(-t "${WORKSHOP_IMAGE}:latest")
          fi
          docker buildx imagetools create "${tags[@]}" \
            "${WORKSHOP_IMAGE}@${AMD64_DIGEST}" \
            "${WORKSHOP_IMAGE}@${ARM64_DIGEST}"
      - name: Verify multi-platform image
        run: |
          image="${WORKSHOP_IMAGE}:sha-${GITHUB_SHA}"
          manifest="$(docker buildx imagetools inspect "$image" --raw)"
          for architecture in amd64 arm64; do
            jq --exit-status --arg architecture "$architecture" \
              'any(.manifests[]; .platform.os == "linux" and .platform.architecture == $architecture)' \
              <<<"$manifest" >/dev/null
          done
          docker buildx imagetools inspect "$image"