name: K3s Release

on:
  release:
    types: [published]

permissions:
  contents: read
  packages: read
  id-token: write

jobs:
  build-amd64:
    name: Build Binary (amd64)
    uses: ./.github/workflows/build-k3s.yaml
    with:
      upload-build: true

  build-arm64:
    name: Build Binary (arm64)
    uses: ./.github/workflows/build-k3s.yaml
    with:
      arch: arm64
      upload-build: true

  build-arm:
    name: Build Binary (arm)
    uses: ./.github/workflows/build-k3s.yaml
    with:
      arch: arm
      upload-build: true

  push-release-image:
    name: Build and Push Multi-Arch Image
    runs-on: ubuntu-latest
    permissions: 
      packages: write # Needed to push images to GHCR
    needs: [build-amd64, build-arm64, build-arm]
    steps:
      - name: Checkout code
        uses: actions/checkout@v5

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Read registry secrets (staging)
        uses: rancher-eio/read-vault-secrets@main
        if: ${{ github.event.release.prerelease && github.repository_owner == 'k3s-io' }}
        with:
          secrets: |
            secret/data/github/repo/${{ github.repository }}/k3s-suse-registry-stg/credentials registry | REGISTRY ;
            secret/data/github/repo/${{ github.repository }}/k3s-suse-registry-stg/credentials username | REGISTRY_USERNAME ;
            secret/data/github/repo/${{ github.repository }}/k3s-suse-registry-stg/credentials password | REGISTRY_PASSWORD

      - name: Read registry secrets (prime)
        uses: rancher-eio/read-vault-secrets@main
        if: ${{ ! github.event.release.prerelease && github.repository_owner == 'k3s-io' }}
        with:
          secrets: |
            secret/data/github/repo/${{ github.repository }}/k3s-suse-registry/credentials registry | REGISTRY ;
            secret/data/github/repo/${{ github.repository }}/k3s-suse-registry/credentials username | REGISTRY_USERNAME ;
            secret/data/github/repo/${{ github.repository }}/k3s-suse-registry/credentials password | REGISTRY_PASSWORD

      - name: "Read Vault secrets"
        if: github.repository_owner == 'k3s-io'
        uses: rancher-eio/read-vault-secrets@main
        with:
          secrets: |
            secret/data/github/repo/${{ github.repository }}/dockerhub/rancher/credentials username | DOCKER_USERNAME ;
            secret/data/github/repo/${{ github.repository }}/dockerhub/rancher/credentials password | DOCKER_TOKEN ;
    
      - name: Login to DockerHub with Rancher Secrets
        if: github.repository_owner == 'k3s-io'
        uses: docker/login-action@v3
        with:
          username: ${{ env.DOCKER_USERNAME }}
          password: ${{ env.DOCKER_TOKEN }}

      # For forks, setup DockerHub login with GHA secrets
      - name: Login to DockerHub with GHA Secrets
        if: github.repository_owner != 'k3s-io'
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_TOKEN }}

      - name: Login to Prime Registry
        if: github.repository_owner == 'k3s-io'
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ env.REGISTRY_USERNAME }}
          password: ${{ env.REGISTRY_PASSWORD }}

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Configure image tags
        id: tag_config
        run: |
          TAG=${GITHUB_REF#refs/tags/}
          
          # Base configuration - always transform the main tag
          # Transforms v1.32.4-rc1+k3s1 → v1.32.4-rc1-k3s1
          BASE_CONFIG="type=raw,value=${TAG//+/-}"
          
          if [[ "${TAG,,}" == *"rc"* ]]; then
            echo "RC release detected: $TAG"
            echo "tag_spec=$BASE_CONFIG" >> $GITHUB_OUTPUT
          else
            echo "Stable release detected: $TAG"
            echo "tag_spec=$BASE_CONFIG
          type=semver,pattern=v{{major}}.{{minor}}" >> $GITHUB_OUTPUT
          fi

      - name: Set DockerHub Org
        run: |
          if [ "${{ github.repository_owner }}" == "k3s-io" ]; then
            echo "DOCKERHUB_ORG=rancher" >> $GITHUB_ENV
          else
            echo "DOCKERHUB_ORG=${{ secrets.DOCKER_USERNAME }}" >> $GITHUB_ENV
          fi

      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: |
            ghcr.io/${{ github.repository_owner }}/k3s
            docker.io/${{ env.DOCKERHUB_ORG }}/k3s
            ${{ env.REGISTRY }}/rancher/k3s
          flavor: latest=false
          tags: ${{ steps.tag_config.outputs.tag_spec }}
      
      - name: "Download K3s build"
        uses: actions/download-artifact@v6
        with:
          pattern: k3s*
          path: ./dist/artifacts
          merge-multiple: true

      - name: Prepare build folder
        run: |
          mkdir -p ./build/out
          cp ./dist/artifacts/data-* ./build/out

      - name: Build and push K3s runtime image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ./package/Dockerfile
          platforms: linux/amd64,linux/arm64,linux/arm/v7
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            DRONE_TAG=${{ github.ref_name }}

  upload-release-airgap:
    name: Build Airgap Pkg (${{ matrix.arch }})
    runs-on: ubuntu-latest # Runs on standard runner, docker pulls with --platform
    permissions: 
      contents: write  # Needed to update release with assets
    strategy:
      matrix:
        arch: [amd64, arm64, arm]

    steps:
      - name: Checkout code
        uses: actions/checkout@v5

      - name: Read Prime artifacts secrets
        uses: rancher-eio/read-vault-secrets@main
        with:
          secrets: |
            secret/data/github/repo/${{ github.repository }}/prime-artifacts-uploader/credentials accessKeyId | AWS_ACCESS_KEY_ID ;
            secret/data/github/repo/${{ github.repository }}/prime-artifacts-uploader/credentials secretAccessKey | AWS_SECRET_ACCESS_KEY ;
            secret/data/github/repo/${{ github.repository }}/prime-artifacts-uploader/credentials primeArtifactsBucketName | PRIME_ARTIFACTS_BUCKET_NAME

      - name: Configure AWS Credentials (s3)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ env.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ env.AWS_SECRET_ACCESS_KEY }}
          aws-region: us-east-1

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Install Dependencies
        run: sudo apt-get update -y && sudo apt-get install -y zstd pigz

      - name: Create Airgap Package (${{ matrix.arch }})
        run: |
          mkdir -p ./dist/artifacts
          ./scripts/package-airgap ${{ matrix.arch }}

      - name: Caculate Airgap sha256sum
        run: sha256sum dist/artifacts/k3s-airgap-images-${{ matrix.arch }}* | sed 's|dist/artifacts/||' > dist/artifacts/k3s-airgap-images-${{ matrix.arch }}.sha256sum

      - name: Upload Airgap sha256sum
        uses: actions/upload-artifact@v5
        with:
          name: k3s-airgap-images-${{ matrix.arch }}.sha256sum
          path: dist/artifacts/k3s-airgap-images-${{ matrix.arch }}.sha256sum
      
      - name: Upload k3s-images.txt to Release
        uses: softprops/action-gh-release@v2
        # This action is recommended by GITHUB, they don't support a first party action for releases
        # See https://github.com/actions/create-release?tab=readme-ov-file#github-action---releases-api
        if: ${{ matrix.arch == 'amd64' }}
        with:
          files: |
            dist/artifacts/k3s-images.txt
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Upload Airgap Assets to Release
        uses: softprops/action-gh-release@v2
        with:
          files: |
            dist/artifacts/k3s-airgap-images*
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Upload Assets
        env:
          S3_PATH: s3://${{ env.PRIME_ARTIFACTS_BUCKET_NAME }}/k3s/${{ github.event.release.tag_name }}
        run: |
          aws s3 sync dist/artifacts/ "$S3_PATH" --quiet --no-progress --exclude "*" --include "k3s-images.txt" --include "k3s-airgap-images*"

  upload-release-assets:
    name: Prepare and Upload Release Assets
    permissions: 
      contents: write # Needed to update release with assets
    runs-on: ubuntu-latest
    needs: [build-amd64, build-arm64, build-arm, upload-release-airgap]
    steps:
    - name: Checkout code
      uses: actions/checkout@v5

    - name: Read Prime artifacts secrets
      uses: rancher-eio/read-vault-secrets@main
      with:
        secrets: |
          secret/data/github/repo/${{ github.repository }}/prime-artifacts-uploader/credentials accessKeyId | AWS_ACCESS_KEY_ID ;
          secret/data/github/repo/${{ github.repository }}/prime-artifacts-uploader/credentials secretAccessKey | AWS_SECRET_ACCESS_KEY ;
          secret/data/github/repo/${{ github.repository }}/prime-artifacts-uploader/credentials primeArtifactsBucketName | PRIME_ARTIFACTS_BUCKET_NAME

    - name: Configure AWS Credentials (s3)
      uses: aws-actions/configure-aws-credentials@v4
      with:
        aws-access-key-id: ${{ env.AWS_ACCESS_KEY_ID }}
        aws-secret-access-key: ${{ env.AWS_SECRET_ACCESS_KEY }}
        aws-region: us-east-1

    - name: "Download Binaries and Airgap sha256sum"
      uses: actions/download-artifact@v6
      with:
        pattern: k3s*
        path: ./dist/artifacts
        merge-multiple: true
    
    - name: "Combine and format sha256sum files"
      run: |
        for arch in amd64 arm64 arm; do
          output_file="./dist/artifacts/sha256sum-${arch}.txt"
          cat ./dist/artifacts/k3s-airgap-images-$arch*.sha256sum >> "$output_file"
          rm ./dist/artifacts/k3s-airgap-images-$arch*.sha256sum
          if [[ "$arch" == "amd64" ]]; then
            cat ./dist/artifacts/k3s.sha256sum >> "$output_file"
            rm ./dist/artifacts/k3s.sha256sum # Remove the original file to avoid uploading it
          else
            cat ./dist/artifacts/k3s-${arch}.sha256sum >> "$output_file"
            rm ./dist/artifacts/k3s-${arch}.sha256sum # Remove the original file to avoid uploading it
          fi
        done    
    
    - name: Upload Assets to Release
      uses: softprops/action-gh-release@v2.2.1
      with:
        files: |
          dist/artifacts/k3s*
          dist/artifacts/sha256sum*
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

    - name: Upload Assets
      env:
        S3_PATH: s3://${{ env.PRIME_ARTIFACTS_BUCKET_NAME }}/k3s/${{ github.event.release.tag_name }}
      run: |
        aws s3 sync dist/artifacts/ "$S3_PATH" --quiet --no-progress --exclude "*" --include "k3s*" --include "sha256sum*"

  dispatch-k3s-upgrade:
    name: Dispatch k3s-upgrade Workflow
    runs-on: ubuntu-latest
    needs: [upload-release-assets]
    steps:
      - name: Dispatch k3s-upgrade Workflow
        run: |
          curl -L -XPOST \
            -H "Accept: application/vnd.github+json" \
            -H "Authorization: Bearer ${{ secrets.K3S_UPGRADE_PAT }}" \
            -H "Content-Type: application/json" \
            https://api.github.com/repos/${{ github.repository_owner }}/k3s-upgrade/dispatches \
            -d '{"event_type":"tag-release","client_payload":{"tag":"${{ github.ref_name }}"}}'

