name: Build OpenWrt Rust SDK images

on:
  workflow_dispatch:
    inputs:
      targets:
        description: 'Comma-separated targets, or all'
        default: 'all'
        required: true
        type: string
      publish:
        description: 'Publish the original Docker Hub tags (requires approval)'
        default: false
        type: boolean

permissions:
  contents: read

jobs:
  matrix:
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.resolve.outputs.matrix }}
    steps:
      - uses: builtin:checkout
      - name: Resolve targets and OpenWrt versions
        id: resolve
        env:
          TARGETS: ${{ inputs.targets }}
        run: |
          python3 -m unittest discover -s ci -p 'test_matrix.py'
          python3 ci/matrix.py

  build:
    needs: matrix
    runs-on: ubuntu-latest
    timeout-minutes: 360
    strategy:
      fail-fast: false
      max-parallel: 1
      matrix: ${{ fromJSON(needs.matrix.outputs.matrix) }}
    env:
      SAFE_TARGET: ${{ matrix.target }}
      VERSION: ${{ matrix.version }}
      AWS_ACCESS_KEY_ID: ${{ secrets.SCCACHE_S3_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.SCCACHE_S3_SECRET_ACCESS_KEY }}
    steps:
      - uses: builtin:checkout
      - name: Prepare persistent builder
        run: sh ci/setup-builder.sh
      - name: Build SDK image
        run: |
          docker buildx build --builder openwrt-sdk-rust --load --progress plain \
            --network host --allow network.host \
            --build-arg SAFE_TARGET="$SAFE_TARGET" \
            --build-arg VERSION="$VERSION" \
            --build-arg JOBS=8 \
            --build-arg SCCACHE_REDIS_ENDPOINT=redis://127.0.0.1:6380 \
            --build-arg SCCACHE_ENDPOINT=http://127.0.0.1:9000 \
            --secret id=aws-access-key-id,env=AWS_ACCESS_KEY_ID \
            --secret id=aws-secret-access-key,env=AWS_SECRET_ACCESS_KEY \
            --tag "lochnair/openwrt-sdk-rust:${SAFE_TARGET}-${VERSION}" .
      - name: Verify SDK image
        run: |
          docker run --rm "lochnair/openwrt-sdk-rust:${SAFE_TARGET}-${VERSION}" sh -ec '
            sccache --version
            grep -qx "CONFIG_RUST_SCCACHE=y" .config
            rustc=$(find staging_dir -type f -path "*/host/bin/rustc")
            test -x "$rustc"
            "$rustc" -vV
            "$(dirname "$rustc")/cargo" --version
          '
          sh ci/verify-cache.sh "lochnair/openwrt-sdk-rust:${SAFE_TARGET}-${VERSION}"
      - name: Publish Docker Hub tag
        if: ${{ success() && inputs.publish == true }}
        env:
          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
        shell: bash
        run: |
          set -euo pipefail
          DOCKER_CONFIG=$(mktemp -d)
          export DOCKER_CONFIG
          trap 'rm -rf "$DOCKER_CONFIG"' EXIT
          printf '%s' "$DOCKERHUB_TOKEN" | docker login --username "$DOCKERHUB_USERNAME" --password-stdin
          docker push "lochnair/openwrt-sdk-rust:${SAFE_TARGET}-${VERSION}"
      - name: Remove local SDK image
        if: always()
        run: |
          image="lochnair/openwrt-sdk-rust:${SAFE_TARGET}-${VERSION}"
          if docker image inspect "$image" >/dev/null 2>&1; then
            docker image rm "$image"
          fi