# Package bot-bottle only after immutable OCI and Firecracker artifacts have
# been published. The inputs are the release boundary: the resulting wheel
# carries these exact identities and production startup never chooses another.

name: package-release

on:
  workflow_dispatch:
    inputs:
      orchestrator_image:
        description: Digest-pinned orchestrator OCI reference
        required: true
      gateway_image:
        description: Digest-pinned gateway OCI reference
        required: true
      firecracker_orchestrator_version:
        description: Published orchestrator rootfs package version
        required: true
      firecracker_orchestrator_sha256:
        description: SHA-256 of orchestrator rootfs.ext4.gz
        required: true
      firecracker_gateway_version:
        description: Published gateway rootfs package version
        required: true
      firecracker_gateway_sha256:
        description: SHA-256 of gateway rootfs.ext4.gz
        required: true

jobs:
  package:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout the release commit
        uses: actions/checkout@v4

      - name: Install package build tooling
        run: python3 -m pip install --break-system-packages build

      - name: Generate immutable release manifest
        run: |
          python3 scripts/generate_release_manifest.py \
            --source-commit "$GITHUB_SHA" \
            --orchestrator-image '${{ inputs.orchestrator_image }}' \
            --gateway-image '${{ inputs.gateway_image }}' \
            --firecracker-orchestrator-version '${{ inputs.firecracker_orchestrator_version }}' \
            --firecracker-orchestrator-sha256 '${{ inputs.firecracker_orchestrator_sha256 }}' \
            --firecracker-gateway-version '${{ inputs.firecracker_gateway_version }}' \
            --firecracker-gateway-sha256 '${{ inputs.firecracker_gateway_sha256 }}' \
            --output release-manifest.json

      - name: Build package with assigned infrastructure pins
        env:
          BOT_BOTTLE_RELEASE_MANIFEST: ${{ github.workspace }}/release-manifest.json
        run: python3 -m build --wheel

      - name: Verify packaged manifest
        run: |
          test "$(find dist -maxdepth 1 -name '*.whl' -type f | wc -l)" -eq 1
          python3 -m venv verify-venv
          verify-venv/bin/pip install --no-deps dist/*.whl
          verify-venv/bin/python -c \
            'from bot_bottle.release_manifest import load_manifest; print(load_manifest())'

      - name: Upload verified release wheel
        uses: actions/upload-artifact@v3
        with:
          name: bot-bottle-release
          path: dist/*.whl