name: docker-image

on:
  push:
    tags:
      - v*

env:
  APP_NAME: CLIProxyAPI
  DOCKERHUB_REPO: eceasy/cli-proxy-api

jobs:
  docker_amd64:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      - name: Login to DockerHub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Generate Build Metadata
        run: |
          echo VERSION=`git describe --tags --always --dirty` >> $GITHUB_ENV
          echo COMMIT=`git rev-parse --short HEAD` >> $GITHUB_ENV
          echo BUILD_DATE=`date -u +%Y-%m-%dT%H:%M:%SZ` >> $GITHUB_ENV
      - name: Build and push (amd64)
        uses: docker/build-push-action@v6
        with:
          context: .
          platforms: linux/amd64
          push: true
          build-args: |
            VERSION=${{ env.VERSION }}
            COMMIT=${{ env.COMMIT }}
            BUILD_DATE=${{ env.BUILD_DATE }}
          tags: |
            ${{ env.DOCKERHUB_REPO }}:latest-amd64
            ${{ env.DOCKERHUB_REPO }}:${{ env.VERSION }}-amd64

  docker_arm64:
    runs-on: ubuntu-24.04-arm
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      - name: Login to DockerHub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Generate Build Metadata
        run: |
          echo VERSION=`git describe --tags --always --dirty` >> $GITHUB_ENV
          echo COMMIT=`git rev-parse --short HEAD` >> $GITHUB_ENV
          echo BUILD_DATE=`date -u +%Y-%m-%dT%H:%M:%SZ` >> $GITHUB_ENV
      - name: Build and push (arm64)
        uses: docker/build-push-action@v6
        with:
          context: .
          platforms: linux/arm64
          push: true
          build-args: |
            VERSION=${{ env.VERSION }}
            COMMIT=${{ env.COMMIT }}
            BUILD_DATE=${{ env.BUILD_DATE }}
          tags: |
            ${{ env.DOCKERHUB_REPO }}:latest-arm64
            ${{ env.DOCKERHUB_REPO }}:${{ env.VERSION }}-arm64

  docker_manifest:
    runs-on: ubuntu-latest
    needs:
      - docker_amd64
      - docker_arm64
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      - name: Login to DockerHub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Generate Build Metadata
        run: |
          echo VERSION=`git describe --tags --always --dirty` >> $GITHUB_ENV
          echo COMMIT=`git rev-parse --short HEAD` >> $GITHUB_ENV
          echo BUILD_DATE=`date -u +%Y-%m-%dT%H:%M:%SZ` >> $GITHUB_ENV
      - name: Create and push multi-arch manifests
        run: |
          docker buildx imagetools create \
            --tag "${DOCKERHUB_REPO}:latest" \
            "${DOCKERHUB_REPO}:latest-amd64" \
            "${DOCKERHUB_REPO}:latest-arm64"
          docker buildx imagetools create \
            --tag "${DOCKERHUB_REPO}:${VERSION}" \
            "${DOCKERHUB_REPO}:${VERSION}-amd64" \
            "${DOCKERHUB_REPO}:${VERSION}-arm64"
      - name: Cleanup temporary tags
        continue-on-error: true
        env:
          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
        run: |
          set -euo pipefail
          namespace="${DOCKERHUB_REPO%%/*}"
          repo_name="${DOCKERHUB_REPO#*/}"

          token="$(
            curl -fsSL \
              -H 'Content-Type: application/json' \
              -d "{\"username\":\"${DOCKERHUB_USERNAME}\",\"password\":\"${DOCKERHUB_TOKEN}\"}" \
              'https://hub.docker.com/v2/users/login/' \
              | python3 -c 'import json,sys; print(json.load(sys.stdin)["token"])'
          )"

          delete_tag() {
            local tag="$1"
            local url="https://hub.docker.com/v2/repositories/${namespace}/${repo_name}/tags/${tag}/"
            local http_code
            http_code="$(curl -sS -o /dev/null -w "%{http_code}" -X DELETE -H "Authorization: JWT ${token}" "${url}" || true)"
            if [ "${http_code}" = "204" ] || [ "${http_code}" = "404" ]; then
              echo "Docker Hub tag removed (or missing): ${DOCKERHUB_REPO}:${tag} (HTTP ${http_code})"
              return 0
            fi
            echo "Docker Hub tag delete failed: ${DOCKERHUB_REPO}:${tag} (HTTP ${http_code})"
            return 0
          }

          delete_tag "latest-amd64"
          delete_tag "latest-arm64"
          delete_tag "${VERSION}-amd64"
          delete_tag "${VERSION}-arm64"