name: Release

on:
  push:
    tags: ["v*"]
  workflow_dispatch:

jobs:
  build-and-publish:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      packages: write
    steps:
      - uses: actions/checkout@v4

      # ─── Python wheels + tarball ───
      - uses: actions/setup-python@v5
        with: { python-version: "3.11" }
      - name: Build wheels & tarball
        run: |
          pip install build
          bash deploy/install/build-artifacts.sh

      # ─── Docker multi-arch ───
      - uses: docker/setup-qemu-action@v3
      - uses: docker/setup-buildx-action@v3
      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Build & push API image
        uses: docker/build-push-action@v5
        with:
          context: .
          file: deploy/docker/Dockerfile.api
          platforms: linux/amd64,linux/arm64
          push: true
          tags: |
            ghcr.io/15code/verify-api:${{ github.ref_name }}
            ghcr.io/15code/verify-api:latest
      - name: Build & push Web image
        uses: docker/build-push-action@v5
        with:
          context: .
          file: deploy/docker/Dockerfile.web
          platforms: linux/amd64,linux/arm64
          push: true
          tags: |
            ghcr.io/15code/verify-web:${{ github.ref_name }}
            ghcr.io/15code/verify-web:latest

      # ─── GitHub Release ───
      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          files: |
            dist/*.whl
            dist/*.tar.gz
            dist/SHA256SUMS.txt
            dist/docker-compose.yml
          body: |
            # 15code Verify ${{ github.ref_name }}

            **Install:**
            ```bash
            pip install 15code-verify==${{ github.ref_name }}
            ```

            **Or Docker:**
            ```bash
            docker pull ghcr.io/15code/verify-api:${{ github.ref_name }}
            docker pull ghcr.io/15code/verify-web:${{ github.ref_name }}
            ```

            Full download options → https://verify.15code.com/download

            --
            Made with ♥ by 15code · https://15code.com

  deploy-production:
    needs: build-and-publish
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/v')
    steps:
      - name: Deploy via SSH
        uses: appleboy/ssh-action@v1
        with:
          host: ${{ secrets.DEPLOY_HOST }}
          username: ${{ secrets.DEPLOY_USER }}
          key: ${{ secrets.DEPLOY_SSH_KEY }}
          script: |
            /opt/15code-verify/deploy/install/update.sh
