name: Publish lark-cli Images

# Publishes the two Lark sandbox runtime images (Pattern A init container and
# Pattern B broker sidecar). These track the upstream `larksuite/cli` release,
# not the DeerFlow `v*` release, so they publish on their own trigger and are
# tagged by the lark-cli version rather than being wired into container.yaml.
on:
  workflow_dispatch:
    inputs:
      lark_cli_version:
        description: "larksuite/cli release to build (e.g. v1.0.65)"
        required: true
        default: v1.0.65
  push:
    tags:
      - "lark-cli-v*"

env:
  REGISTRY: ghcr.io

jobs:
  build-images:
    # Only publish from the upstream repo; a fork dispatch/tag skips the job.
    if: github.repository == 'bytedance/deer-flow'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      attestations: write
      id-token: write
    strategy:
      fail-fast: false
      matrix:
        include:
          # Pattern A init image: relative `COPY build-runtime.sh entrypoint.sh`,
          # so the build context is its own dir.
          - component: lark-cli-init
            context: docker/lark-cli-init
            file: docker/lark-cli-init/Dockerfile
          # Pattern B broker image: copies the shared build-runtime.sh and the
          # harness module, so the build context is the repo root.
          - component: lark-cli-broker
            context: .
            file: docker/lark-cli-broker/Dockerfile
    env:
      IMAGE_NAME: ${{ github.repository }}-${{ matrix.component }}
    steps:
      - name: Resolve lark-cli version
        id: version
        # workflow_dispatch supplies it as an input; a `lark-cli-v*` tag encodes
        # it after the prefix (lark-cli-v1.0.65 -> v1.0.65). The input is passed
        # via env (not interpolated into the script) to avoid shell expression
        # injection if the repo gate on dispatch ever widens.
        env:
          LARK_CLI_VERSION_INPUT: ${{ inputs.lark_cli_version }}
        run: |
          if [ -n "$LARK_CLI_VERSION_INPUT" ]; then
            version="$LARK_CLI_VERSION_INPUT"
          else
            version="${GITHUB_REF_NAME#lark-cli-}"
          fi
          echo "value=${version}" >> "$GITHUB_OUTPUT"
      - name: Checkout repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
      - name: Set up QEMU
        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 #v3.6.0
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 #v3.11.1
      - name: Log in to the Container registry
        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 #v3.4.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 #v5.7.0
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          # Tag by the lark-cli version (not the DeerFlow release). No `latest`.
          tags: |
            type=raw,value=${{ steps.version.outputs.value }}
      - name: Build and push Docker image
        id: push
        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 #v6.18.0
        with:
          context: ${{ matrix.context }}
          file: ${{ matrix.file }}
          push: true
          # The sidecar/init image ships a real arch-dispatched lark-cli binary,
          # so publish both arches the sandbox may run on.
          platforms: linux/amd64,linux/arm64
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            LARK_CLI_VERSION=${{ steps.version.outputs.value }}
      - name: Generate artifact attestation
        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be #v2.4.0
        with:
          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          subject-digest: ${{ steps.push.outputs.digest }}
          push-to-registry: true