name: Red Hat Certification Release

on:
  workflow_dispatch:
    inputs:
      version:
        description: "EDDI version (e.g. 6.1.0)"
        required: true
        default: "6.1.0"
      release:
        description: "Release number (e.g. 1, 2, 3)"
        required: true
        default: "1"
      submit:
        description: "Submit results to Red Hat (true/false)"
        required: true
        default: "true"
        type: choice
        options: ["true", "false"]
      registry:
        description: "Target registry"
        required: true
        default: "docker.io"
        type: choice
        options: ["docker.io", "quay.io"]

permissions:
  contents: read

jobs:
  build-and-certify:
    name: Build, Push & Certify
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Set up JDK 25
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
        with:
          distribution: temurin
          java-version: "25"
          cache: maven

      - name: Set execute permission for mvnw
        run: chmod +x mvnw

      - name: Build application (generates licenses automatically)
        run: ./mvnw clean package -DskipTests -Plicense-gen -B

      - name: Verify licenses generated
        run: |
          echo "=== THIRD-PARTY.txt (first 50 lines) ==="
          head -50 licenses/THIRD-PARTY.txt || echo "THIRD-PARTY.txt not found!"
          echo ""
          echo "=== Downloaded license files ==="
          ls -la licenses/third-party/ 2>/dev/null | head -20 || echo "No third-party dir found!"
          echo "Total license files: $(ls licenses/third-party/ 2>/dev/null | wc -l)"

      - name: Set image coordinates
        id: image
        run: |
          REGISTRY="${{ inputs.registry }}"
          IMAGE="${REGISTRY}/labsai/eddi"
          TAG="${{ inputs.version }}-${{ inputs.release }}"
          echo "full=${IMAGE}:${TAG}" >> $GITHUB_OUTPUT
          echo "image=${IMAGE}" >> $GITHUB_OUTPUT
          echo "tag=${TAG}" >> $GITHUB_OUTPUT

      - name: Login to registry
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
        with:
          registry: ${{ inputs.registry }}
          username: ${{ inputs.registry == 'quay.io' && secrets.QUAY_USERNAME || secrets.DOCKER_USERNAME }}
          password: ${{ inputs.registry == 'quay.io' && secrets.QUAY_PASSWORD || secrets.DOCKER_PASSWORD }}

      - name: Build Docker image with Red Hat labels
        run: |
          docker build \
            --build-arg EDDI_VERSION=${{ inputs.version }} \
            --build-arg EDDI_RELEASE=${{ inputs.release }} \
            -f src/main/docker/Dockerfile \
            -t ${{ steps.image.outputs.full }} \
            -t ${{ steps.image.outputs.image }}:${{ inputs.version }} \
            -t ${{ steps.image.outputs.image }}:latest \
            .

      - name: Verify Red Hat labels
        run: |
          echo "=== Container Labels ==="
          docker inspect ${{ steps.image.outputs.full }} \
            --format '{{json .Config.Labels}}' | python3 -m json.tool

      - name: Verify /licenses in container
        run: |
          echo "=== /licenses directory ==="
          docker run --rm --entrypoint="" ${{ steps.image.outputs.full }} \
            ls -la /licenses/
          echo ""
          echo "=== THIRD-PARTY.txt in container ==="
          docker run --rm --entrypoint="" ${{ steps.image.outputs.full }} \
            head -30 /licenses/THIRD-PARTY.txt || true

      - name: Push to registry
        run: |
          docker push ${{ steps.image.outputs.full }}
          docker push ${{ steps.image.outputs.image }}:${{ inputs.version }}
          docker push ${{ steps.image.outputs.image }}:latest

      - name: Install preflight
        env:
          PREFLIGHT_VERSION: "1.17.1"
          PREFLIGHT_SHA256: "15f58d0de7212ac948706515f824d0d2f42b94c11fa85cdb1bc08ad8993226ca"
        run: |
          echo "Installing preflight ${PREFLIGHT_VERSION}..."
          curl -sL "https://github.com/redhat-openshift-ecosystem/openshift-preflight/releases/download/${PREFLIGHT_VERSION}/preflight-linux-amd64" \
            -o /usr/local/bin/preflight
          echo "${PREFLIGHT_SHA256}  /usr/local/bin/preflight" | sha256sum -c -
          chmod +x /usr/local/bin/preflight
          preflight --version

      - name: Run preflight check
        env:
          REDHAT_API_TOKEN: ${{ secrets.REDHAT_API_TOKEN }}
          REDHAT_CERT_PROJECT_ID: ${{ secrets.REDHAT_CERT_PROJECT_ID }}
        run: |
          # Pass credentials via preflight's native env vars (avoids process-listing exposure)
          if [ -n "$REDHAT_API_TOKEN" ] && [ -n "$REDHAT_CERT_PROJECT_ID" ]; then
            export PFLT_PYXIS_API_TOKEN="$REDHAT_API_TOKEN"
            export PFLT_CERTIFICATION_COMPONENT_ID="$REDHAT_CERT_PROJECT_ID"
          else
            echo "::warning::REDHAT_API_TOKEN or REDHAT_CERT_PROJECT_ID secret is missing"
          fi

          SUBMIT_FLAG=""
          if [ "${{ inputs.submit }}" = "true" ]; then
            SUBMIT_FLAG="--submit"
          fi

          preflight check container \
            ${{ steps.image.outputs.full }} \
            --docker-config=${HOME}/.docker/config.json \
            ${SUBMIT_FLAG} \
            2>&1 | tee preflight-results.txt
          PREFLIGHT_EXIT=${PIPESTATUS[0]}
          echo ""
          echo "=== Preflight Summary ==="
          if [ "$PREFLIGHT_EXIT" -ne 0 ] || grep -q "FAILED" preflight-results.txt; then
            echo "::error::Preflight certification check FAILED (exit code: ${PREFLIGHT_EXIT})"
            echo "The container will not pass Red Hat certification in its current state."
            exit 1
          else
            echo "✅ All preflight checks passed"
            if [ -n "$SUBMIT_FLAG" ]; then
              echo "📤 Results submitted to Red Hat Partner Connect"
            fi
          fi

      - name: Upload preflight results
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: preflight-results
          path: |
            preflight-results.txt
            artifacts/
          retention-days: 30
