name: Tagged Release

on:
  push:
    tags:
      - "v*.*.*"

permissions:
  contents: write

jobs:
  build-release:
    runs-on: ubuntu-latest
    env:
      # Preserve the explicitly installed test extras across each uv run invocation.
      UV_NO_SYNC: "1"
    steps:
      - uses: actions/checkout@v5
      - uses: astral-sh/setup-uv@v7
        with:
          enable-cache: true
      - uses: actions/setup-python@v6
        with:
          python-version-file: .python-version
      - run: uv sync --group dev --extra hunt --extra semantic
      - run: uv run ruff format --check .
      - run: uv run ruff check .
      - run: uv run mypy src/openultrasast
      - name: Run release tests
        run: |
          if [[ "${GITHUB_REF_NAME}" == *-* ]]; then
            # The alpha checkpoint archives the implemented core while the benchmark owner resolves the
            # documented task-11.4 reservation/lifecycle conflict. Stable tags retain the complete gate.
            uv run pytest \
              --deselect=tests/test_independent_population.py::test_no_reserved_repository_is_referenced_by_the_development_tree
          else
            uv run pytest
          fi
      - run: uv build
      - uses: softprops/action-gh-release@v2
        with:
          files: |
            dist/*.whl
            dist/*.tar.gz
          body_path: RELEASE_NOTES.md
          generate_release_notes: true
          prerelease: ${{ contains(github.ref_name, '-') }}
          make_latest: ${{ !contains(github.ref_name, '-') }}

  images:
    # The scan image (Joern + php-cli, `docker run ... scan`) and the plane's task runner, pushed to GHCR under the
    # tag's version. Pin them by the digests this job prints, not by tag: Agent Substrate rejects tags.
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: openultrasast
            dockerfile: Dockerfile
          - name: openultrasast-runner
            dockerfile: plane/Dockerfile.runner
    steps:
      - uses: actions/checkout@v5
      - uses: docker/setup-buildx-action@v3
      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - id: meta
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/${{ github.repository_owner }}/${{ matrix.name }}
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}},enable=${{ !contains(github.ref_name, '-') }}
            type=raw,value=latest,enable=${{ !contains(github.ref_name, '-') }}
      - id: build
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ${{ matrix.dockerfile }}
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
      - run: |
          echo "ghcr.io/${{ github.repository_owner }}/${{ matrix.name }}@${{ steps.build.outputs.digest }}" >> "$GITHUB_STEP_SUMMARY"