name: pinned-zig-toolchain-image

on:
  workflow_call:
    inputs:
      validation_rids:
        type: string
        default: '[]'
    outputs:
      image:
        description: Immutable Debian 12 Zig toolchain image reference
        value: ${{ jobs.image.outputs.image }}
  workflow_dispatch:

permissions:
  contents: read
  packages: write

jobs:
  image:
    runs-on: ubuntu-24.04
    timeout-minutes: 60
    outputs:
      image: ${{ steps.publish.outputs.image }}
    steps:
      - uses: actions/checkout@v4
      - name: Publish or reuse exact toolchain image
        id: publish
        env:
          GH_TOKEN: ${{ github.token }}
          ACTOR: ${{ github.actor }}
          REPOSITORY: ${{ github.repository }}
          VALIDATION_RIDS: ${{ inputs.validation_rids || '[]' }}
          BASE_HASH: ${{ hashFiles('build/linux-toolchain/Dockerfile') }}
          RECIPE_HASH: ${{ hashFiles('build/linux-toolchain/Dockerfile*', 'build/linux-toolchain/*.py', 'build/linux-toolchain/*.c', 'build/linux-toolchain/*.gn.in', 'build/linux-toolchain/*lock.json', 'build/linux-toolchain/versions/*.json', 'build/linux-toolchain/patches/**') }}
        run: |
          set -euo pipefail
          printf '%s' "$GH_TOKEN" | docker login ghcr.io -u "$ACTOR" --password-stdin
          repository="ghcr.io/${REPOSITORY,,}-zig"
          image="$repository:recipe-$RECIPE_HASH"
          base="$repository:debian12-$BASE_HASH"
          built_image=false
          if ! docker pull "$image"; then
            if ! docker pull "$base"; then
              docker build --platform linux/amd64 \
                --label "org.opencontainers.image.source=https://github.com/$REPOSITORY" \
                -t "$base" build/linux-toolchain
              docker push "$base"
              docker pull "$base"
            fi
            base_digest="$(docker image inspect --format '{{index .RepoDigests 0}}' "$base")"
            docker build --platform linux/amd64 \
              --build-arg "TOOLCHAIN_IMAGE=$base_digest" \
              --label "org.opencontainers.image.source=https://github.com/$REPOSITORY" \
              -f build/linux-toolchain/Dockerfile.cross-probe \
              -t "$image" build/linux-toolchain
            built_image=true
          fi
          mkdir -p artifacts/toolchain-environment
          docker run --rm --user "$(id -u):$(id -g)" \
            -e HOME=/tmp -e DOTNET_CLI_HOME=/tmp -e ZIG_GLOBAL_CACHE_DIR=/tmp/zig-cache \
            -v "$PWD/artifacts/toolchain-environment:/validation" \
            --entrypoint python3 "$image" /opt/staticlink/validate-toolchain.py --output /validation --rids "$VALIDATION_RIDS"
          if [ "$built_image" = true ]; then
            docker push "$image"
            docker pull "$image"
          fi
          digest="$(docker image inspect --format '{{index .RepoDigests 0}}' "$image")"
          case "$digest" in "$repository"@sha256:*) ;; *) echo 'No immutable image digest' >&2; exit 1 ;; esac
          echo "image=$digest" >> "$GITHUB_OUTPUT"
          echo "Toolchain: $digest" >> "$GITHUB_STEP_SUMMARY"
      - name: Upload environment validation report
        if: ${{ always() }}
        uses: actions/upload-artifact@v4
        with:
          name: toolchain-environment-validation
          path: artifacts/toolchain-environment/
          if-no-files-found: warn