name: Release Publish

# Builds the Nquiry application image and pushes it to ECR Public (always)
# and AWS Marketplace ECR (if MARKETPLACE_ECR_URI is set). Triggered on
# semver tag push or manually via workflow_dispatch.
#
# The pushed image tag is read from infrastructure/terraform/modules/nquiry-stack/VERSION
# at the tagged ref. This must match the tag name — the workflow fails fast
# if they differ. This is the NQU-645 Decision 2 lock enforcement at the
# publish boundary (module pin and image tag cannot drift).

on:
  push:
    tags:
      - "v*.*.*"
  workflow_dispatch:
    inputs:
      tag:
        description: "Version tag to publish (must match infrastructure/terraform/modules/nquiry-stack/VERSION at HEAD; e.g. v0.1.0)"
        required: true
        type: string

permissions:
  id-token: write # OIDC
  contents: read

jobs:
  publish:
    runs-on: ubuntu-latest
    concurrency:
      group: release-publish-${{ github.event_name == 'push' && github.ref_name || github.event.inputs.tag }}
      cancel-in-progress: false

    env:
      AWS_REGION: us-east-1
      VERSION_FILE: infrastructure/terraform/modules/nquiry-stack/VERSION

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.inputs.tag || github.ref }}

      - name: Resolve target version
        id: version
        run: |
          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
            TAG="${{ github.event.inputs.tag }}"
          else
            TAG="${GITHUB_REF#refs/tags/}"
          fi
          VERSION_FILE_CONTENT=$(tr -d '[:space:]' < "$VERSION_FILE")
          echo "Tag:              $TAG"
          echo "VERSION file:     $VERSION_FILE_CONTENT"
          if [[ "$TAG" != "$VERSION_FILE_CONTENT" ]]; then
            echo "::error::Tag ($TAG) does not match $VERSION_FILE ($VERSION_FILE_CONTENT). NQU-645 Decision 2 lock violated."
            exit 1
          fi
          echo "tag=$TAG" >> "$GITHUB_OUTPUT"

      - name: Configure AWS credentials (OIDC)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
          aws-region: ${{ env.AWS_REGION }}

      - name: Login to Amazon ECR Public
        id: ecr-public-login
        uses: aws-actions/amazon-ecr-login@v2
        with:
          registry-type: public

      - name: Build customer image
        env:
          ECR_PUBLIC_REGISTRY: ${{ steps.ecr-public-login.outputs.registry }}
          ECR_PUBLIC_REPO: ${{ secrets.ECR_PUBLIC_REPO }}
          TAG: ${{ steps.version.outputs.tag }}
        run: |
          # NEXT_PUBLIC_* values are customer-runtime-overridable in v0.2.0+.
          # For v0.1.0 the image bakes placeholders; customer config is set
          # via ECS task definition env vars and a runtime substitution layer
          # planned for the v0.2.0 cut. See docs/licensee/release-notes/v0.1.0.md
          # known issues.
          docker build \
            --build-arg NEXT_PUBLIC_COGNITO_USER_POOL_ID="customer-override-at-deploy" \
            --build-arg NEXT_PUBLIC_COGNITO_CLIENT_ID="customer-override-at-deploy" \
            --build-arg NEXT_PUBLIC_APP_URL="https://customer-override-at-deploy" \
            --build-arg AI_PROVIDER="bedrock" \
            --build-arg APP_AWS_REGION="us-east-1" \
            -t "nquiry-app:$TAG" \
            .

      - name: Push to ECR Public
        env:
          ECR_PUBLIC_REGISTRY: ${{ steps.ecr-public-login.outputs.registry }}
          ECR_PUBLIC_REPO: ${{ secrets.ECR_PUBLIC_REPO }}
          TAG: ${{ steps.version.outputs.tag }}
        run: |
          # NQU-807: secret holds just the repo name (e.g., invapp-dev-app).
          # The registry alias is discovered at runtime via aws ecr-public
          # describe-registries so customers/operators set the secret to the
          # bare repo name from terraform output. If the secret accidentally
          # includes an alias prefix (legacy <alias>/<repo> format) we accept
          # it and strip — backwards compatible with existing setups.
          if [[ -z "$ECR_PUBLIC_REPO" ]]; then
            echo "::error::ECR_PUBLIC_REPO secret is not set. Run terraform apply in environments/dev and copy the repository_name portion of module.cicd.ecr_public_repository_uri into the secret (the part after public.ecr.aws/<alias>/)."
            exit 1
          fi
          ALIAS=$(aws ecr-public describe-registries --region us-east-1 --query 'registries[0].aliases[0].name' --output text)
          if [[ -z "$ALIAS" || "$ALIAS" == "None" ]]; then
            echo "::error::No ECR Public registry alias found for this account. Provision one in the ECR Public console under Settings > Registry alias."
            exit 1
          fi
          # Strip any accidental <alias>/ prefix from the secret to be backwards compatible.
          REPO_NAME="${ECR_PUBLIC_REPO##*/}"
          FULL_URI="$ECR_PUBLIC_REGISTRY/$ALIAS/$REPO_NAME:$TAG"
          docker tag "nquiry-app:$TAG" "$FULL_URI"
          docker push "$FULL_URI"
          echo "Pushed to ECR Public: $FULL_URI"
          echo "PUBLISHED_URI=$FULL_URI" >> "$GITHUB_ENV"

      - name: Push to Marketplace ECR (if configured)
        if: ${{ vars.MARKETPLACE_ECR_URI != '' }}
        env:
          MARKETPLACE_ECR_URI: ${{ vars.MARKETPLACE_ECR_URI }}
          TAG: ${{ steps.version.outputs.tag }}
        run: |
          # Marketplace ECR lives in the AWS Marketplace seller account (709825985650).
          # Auth uses the same ECR API but a separate `aws ecr get-login-password` flow.
          aws ecr get-login-password --region us-east-1 \
            | docker login --username AWS --password-stdin "$(echo "$MARKETPLACE_ECR_URI" | cut -d/ -f1)"
          docker tag "nquiry-app:$TAG" "$MARKETPLACE_ECR_URI:$TAG"
          docker push "$MARKETPLACE_ECR_URI:$TAG"
          echo "Pushed to Marketplace ECR: $MARKETPLACE_ECR_URI:$TAG"

      - name: Summary
        env:
          TAG: ${{ steps.version.outputs.tag }}
          MARKETPLACE_ECR_URI: ${{ vars.MARKETPLACE_ECR_URI }}
        run: |
          {
            echo "## Release $TAG published"
            echo ""
            echo "| Target | URI |"
            echo "| --- | --- |"
            echo "| ECR Public | \`${PUBLISHED_URI:-unknown}\` |"
            if [[ -n "$MARKETPLACE_ECR_URI" ]]; then
              echo "| Marketplace ECR | \`$MARKETPLACE_ECR_URI:$TAG\` |"
            else
              echo "| Marketplace ECR | _skipped — \`vars.MARKETPLACE_ECR_URI\` not set_ |"
            fi
          } >> "$GITHUB_STEP_SUMMARY"
