name: Release
permissions: {}

on:
  push:
    tags:
      - 'v[0-9]+.[0-9]+.[0-9]+*'

jobs:
  docker-build:
    name: Release web-vault
    environment: release
    permissions:
      packages: write # Needed to upload packages and artifacts
      contents: read
      # attestations: write # Needed to generate an artifact attestation for a build
      # id-token: write # Needed to mint the OIDC token necessary to request a Sigstore signing certificate
    runs-on: ubuntu-latest
    env:
      # Force docker to output the progress in plain
      BUILDKIT_PROGRESS: plain
      # vars.DOCKERHUB_REPO needs to be '<user>/<repo>', for example 'vaultwarden/web-vault'
      # Check for Docker hub credentials in secrets
      HAVE_DOCKERHUB_LOGIN: ${{ vars.DOCKERHUB_REPO != '' && secrets.DOCKERHUB_USERNAME != '' && secrets.DOCKERHUB_TOKEN != '' }}
      # vars.GHCR_REPO needs to be 'ghcr.io/<user>/<repo>'
      # Check for Github credentials in secrets
      HAVE_GHCR_LOGIN: ${{ vars.GHCR_REPO != '' && github.repository_owner != '' && secrets.GITHUB_TOKEN != '' }}
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      # Determine Docker Tag
      - name: Init Variables
        id: vars
        shell: bash
        run: |
          if [[ "${{ github.ref }}" == refs/tags/* ]]; then
            DOCKER_TAG="${GITHUB_REF#refs/*/}"
          elif [[ "${{ github.ref }}" == refs/heads/* ]]; then
            DOCKER_TAG="testing"
          fi
          # We use `+build.n` to version patches when there was no change to the web-vault version from upstream
          # Container images are not allowed to contain `+` chars, replace them with an `_`
          # Since we do not use container names anyway this isn't an issue for matching and only used for the version
          echo "DOCKER_TAG=${DOCKER_TAG//+/_}" | tee -a "${GITHUB_OUTPUT}"

      # Login to Docker Hub
      - name: Login to Docker Hub
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
        if: ${{ env.HAVE_DOCKERHUB_LOGIN == 'true' }}

      - name: Tags for DockerHub
        if: ${{ env.HAVE_DOCKERHUB_LOGIN == 'true' }}
        shell: bash
        run: |
          echo "tags=${tags:+${tags},}${{ vars.DOCKERHUB_REPO }}:${{ steps.vars.outputs.DOCKER_TAG }}" \
            | tee -a "${GITHUB_ENV}"

      # Login to GitHub Container Registry
      - name: Login to GitHub Container Registry
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
        if: ${{ env.HAVE_GHCR_LOGIN == 'true' }}

      - name: Tags for ghcr.io
        if: ${{ env.HAVE_GHCR_LOGIN == 'true' }}
        shell: bash
        run: |
          echo "tags=${tags:+${tags},}${{ vars.GHCR_REPO }}:${{ steps.vars.outputs.DOCKER_TAG }}" \
            | tee -a "${GITHUB_ENV}"

      - name: Build and push
        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
        with:
          context: .
          push: true
          tags: ${{ env.tags }}