name: release

on:
  workflow_dispatch:
    inputs:
      caddy-version:
        description: Caddy version, like 2.11.4 (defaults to the latest release)
        required: false
        type: string
      caddy-tailscale-version:
        description: caddy-tailscale version, commit, or branch (defaults to the latest)
        required: false
        type: string
      caddy-ratelimit-version:
        description: caddy-ratelimit version, commit, or branch (defaults to the latest)
        required: false
        type: string
      caddy-dnsimple-version:
        description: caddy-dns/dnsimple version, commit, or branch (defaults to the latest)
        required: false
        type: string

permissions: {}

concurrency:
  group: release
  cancel-in-progress: false

jobs:
  release:
    runs-on: ubuntu-latest
    permissions:
      contents: write # checkout, and cut the release.
      packages: write # push image to GHCR.

    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Resolve versions
        id: versions
        env:
          GH_TOKEN: ${{ github.token }}
          INPUTS_CADDY_VERSION: ${{ inputs.caddy-version }}
          INPUTS_CADDY_TAILSCALE_VERSION: ${{ inputs.caddy-tailscale-version }}
          INPUTS_CADDY_RATELIMIT_VERSION: ${{ inputs.caddy-ratelimit-version }}
          INPUTS_CADDY_DNSIMPLE_VERSION: ${{ inputs.caddy-dnsimple-version }}
        run: |
          set -euo pipefail

          latest=$(gh api repos/caddyserver/caddy/releases/latest --jq .tag_name)
          latest=${latest#v}
          caddy=${INPUTS_CADDY_VERSION#v}
          caddy=${caddy:-$latest}
          if [[ ! $caddy =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "::error::Caddy version '$caddy' isn't in X.Y.Z form."
            exit 1
          fi
          if ! docker manifest inspect "caddy:$caddy-builder" > /dev/null; then
            echo "::error::caddy:$caddy-builder isn't on Docker Hub. Check the version, or wait for the official image to publish it."
            exit 1
          fi

          # Pin plugins to concrete module versions so the build cache can't serve stale ones.
          resolve() {
            local module=$1 query=$2 url info
            if [[ ! $query =~ ^[a-z0-9._-]*$ ]]; then
              echo "::error::$module version '$query' may only contain lowercase letters, digits, '.', '_', and '-'." >&2
              return 1
            fi
            if [[ -z $query ]]; then
              url="https://proxy.golang.org/$module/@latest"
            else
              url="https://proxy.golang.org/$module/@v/$query.info"
            fi
            if ! info=$(curl -fsSL "$url"); then
              echo "::error::The Go module proxy couldn't resolve $module@${query:-latest}." >&2
              return 1
            fi
            jq -r .Version <<< "$info"
          }
          tailscale=$(resolve github.com/tailscale/caddy-tailscale "$INPUTS_CADDY_TAILSCALE_VERSION")
          ratelimit=$(resolve github.com/mholt/caddy-ratelimit "$INPUTS_CADDY_RATELIMIT_VERSION")
          dnsimple=$(resolve github.com/caddy-dns/dnsimple "$INPUTS_CADDY_DNSIMPLE_VERSION")

          is_latest=false
          [[ $caddy == "$latest" ]] && is_latest=true

          {
            echo "caddy=$caddy"
            echo "calver=$(date -u +%Y.%m.%d)"
            echo "latest=$is_latest"
            echo "tailscale=$tailscale"
            echo "ratelimit=$ratelimit"
            echo "dnsimple=$dnsimple"
          } >> "$GITHUB_OUTPUT"

          {
            echo "| Component | Version |"
            echo "| --- | --- |"
            echo "| Caddy | $caddy |"
            echo "| caddy-tailscale | $tailscale |"
            echo "| caddy-ratelimit | $ratelimit |"
            echo "| caddy-dns/dnsimple | $dnsimple |"
          } >> "$GITHUB_STEP_SUMMARY"

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0

      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        with:
          images: ghcr.io/kejadlen/caddy-kejadlen
          flavor: latest=false
          tags: |
            type=raw,value=${{ steps.versions.outputs.caddy }}-${{ steps.versions.outputs.calver }}
            type=raw,value=${{ steps.versions.outputs.caddy }}
            type=raw,value=latest,enable=${{ steps.versions.outputs.latest }}
          labels: |
            dev.kejadlen.caddy-tailscale.version=${{ steps.versions.outputs.tailscale }}
            dev.kejadlen.caddy-ratelimit.version=${{ steps.versions.outputs.ratelimit }}
            dev.kejadlen.caddy-dnsimple.version=${{ steps.versions.outputs.dnsimple }}

      - name: Log in to the Container registry
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push Docker image
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          push: true
          build-args: |
            CADDY_VERSION=${{ steps.versions.outputs.caddy }}
            CADDY_TAILSCALE_VERSION=${{ steps.versions.outputs.tailscale }}
            CADDY_RATELIMIT_VERSION=${{ steps.versions.outputs.ratelimit }}
            CADDY_DNSIMPLE_VERSION=${{ steps.versions.outputs.dnsimple }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Create GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
          STEPS_VERSIONS_OUTPUTS_CADDY: ${{ steps.versions.outputs.caddy }}
          STEPS_VERSIONS_OUTPUTS_CALVER: ${{ steps.versions.outputs.calver }}
          STEPS_VERSIONS_OUTPUTS_TAILSCALE: ${{ steps.versions.outputs.tailscale }}
          STEPS_VERSIONS_OUTPUTS_RATELIMIT: ${{ steps.versions.outputs.ratelimit }}
          STEPS_VERSIONS_OUTPUTS_DNSIMPLE: ${{ steps.versions.outputs.dnsimple }}
          STEPS_META_OUTPUTS_TAGS: ${{ steps.meta.outputs.tags }}
        run: |
          set -euo pipefail

          tag="v$STEPS_VERSIONS_OUTPUTS_CADDY-$STEPS_VERSIONS_OUTPUTS_CALVER"

          # Indented code blocks instead of fences: backticks in --notes-file are
          # fine, but these notes also go through echo.
          {
            echo "| Component | Version |"
            echo "| --- | --- |"
            echo "| Caddy | $STEPS_VERSIONS_OUTPUTS_CADDY |"
            echo "| caddy-tailscale | $STEPS_VERSIONS_OUTPUTS_TAILSCALE |"
            echo "| caddy-ratelimit | $STEPS_VERSIONS_OUTPUTS_RATELIMIT |"
            echo "| caddy-dns/dnsimple | $STEPS_VERSIONS_OUTPUTS_DNSIMPLE |"
            echo
            echo "Images pushed:"
            echo
            sed 's/^/    /' <<< "$STEPS_META_OUTPUTS_TAGS"
          } > notes.md

          # A same-day rebuild reuses the image tag, so reuse the release too.
          if gh release view "$tag" > /dev/null 2>&1; then
            gh release edit "$tag" --title "$tag" --notes-file notes.md
          else
            gh release create "$tag" --target "$GITHUB_SHA" --title "$tag" --notes-file notes.md
          fi