name: Release

# No image registry involved: Portainer is wired to this repo's Git remote
# and builds/redeploys apps/api/Dockerfile itself. This workflow sanity-checks
# that the image actually builds at the tagged commit, publishes a GitHub
# Release, then (best-effort) pings Portainer's deploy webhook so it doesn't
# have to wait for its own polling interval.
on:
  push:
    tags: ["v*.*.*"]

permissions:
  contents: write

jobs:
  sanity-build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      # Build only, no push, no registry — just confirms Portainer will be
      # able to build this same Dockerfile successfully at this tag before
      # anyone points it at this ref.
      - run: docker build -f apps/api/Dockerfile .

  github-release:
    runs-on: ubuntu-latest
    needs: sanity-build
    steps:
      - uses: actions/checkout@v4

      - uses: softprops/action-gh-release@v2
        with:
          # Auto-generated from merged PRs since the previous tag — no
          # changelog tooling to maintain, consistent with there being no
          # versioning tooling elsewhere in the repo yet.
          generate_release_notes: true

  notify-portainer:
    runs-on: ubuntu-latest
    needs: github-release
    steps:
      - name: Trigger Portainer redeploy
        # Best-effort: does nothing (and doesn't fail the workflow) until
        # the PORTAINER_WEBHOOK_URL repo secret is set — grab that URL from
        # the stack's webhook setting in Portainer and add it as a secret
        # named PORTAINER_WEBHOOK_URL (see README).
        env:
          PORTAINER_WEBHOOK_URL: ${{ secrets.PORTAINER_WEBHOOK_URL }}
        run: |
          if [ -z "$PORTAINER_WEBHOOK_URL" ]; then
            echo "PORTAINER_WEBHOOK_URL not set — skipping, Portainer will pick this up on its next poll."
            exit 0
          fi
          curl -fsS -X POST "$PORTAINER_WEBHOOK_URL"