name: Publish Factory Kubernetes image

on:
  push:
    branches: [main]
    paths:
      - modules/harness/factory/**
      - modules/repository-registry/**
      - modules/sandbox/registry-gateway/**
      - package.json
      - pnpm-lock.yaml
      - pnpm-workspace.yaml
      - .npmrc
      - .github/workflows/factory-kubernetes-image.yml

permissions:
  contents: read
  packages: write

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c
        with:
          driver-opts: network=host
      - name: Start immutable registry snapshot
        env:
          QUERY_REACT_TGZ_B64: ${{ secrets.FACTORY_QUERY_REACT_TGZ_B64 }}
          UI_PRIMITIVES_TGZ_B64_1: ${{ secrets.FACTORY_UI_PRIMITIVES_TGZ_B64_1 }}
          UI_PRIMITIVES_TGZ_B64_2: ${{ secrets.FACTORY_UI_PRIMITIVES_TGZ_B64_2 }}
          UI_TOKENS_TGZ_B64: ${{ secrets.FACTORY_UI_TOKENS_TGZ_B64 }}
        run: |
          set -eu
          test -n "$QUERY_REACT_TGZ_B64"
          test -n "$UI_PRIMITIVES_TGZ_B64_1"
          test -n "$UI_PRIMITIVES_TGZ_B64_2"
          test -n "$UI_TOKENS_TGZ_B64"
          private="$RUNNER_TEMP/factory-private-packages"
          mirror="$RUNNER_TEMP/platform-registry-mirror"
          mkdir -p "$private" "$mirror"
          printf '%s' "$QUERY_REACT_TGZ_B64" | base64 --decode >"$private/query-react.tgz"
          { printf '%s' "$UI_PRIMITIVES_TGZ_B64_1"; printf '%s' "$UI_PRIMITIVES_TGZ_B64_2"; } \
            | base64 --decode >"$private/ui-primitives.tgz"
          printf '%s' "$UI_TOKENS_TGZ_B64" | base64 --decode >"$private/ui-tokens.tgz"
          printf '%s  %s\n' \
            2a2cfe724f7722ed87a092c7e99e1615946ba133928312ac968fc1c9d2f8dca9 "$private/query-react.tgz" \
            2f5a552cd9589a26336f01f62b05864c1c3b76f19c86f78b08aa45255dfd2443 "$private/ui-primitives.tgz" \
            dc363a6d34043c94f57d2163df95adcd83ed3838ac7083f39c1f0f460f0a6a5e "$private/ui-tokens.tgz" \
            | sha256sum --check --strict
          node modules/sandbox/registry-gateway/admit-package.mjs "$private/query-react.tgz" \
            @platform-modules/query-react 0.1.0 "$mirror" http://100.101.104.41:4873 2026-07-06T07:29:58Z
          node modules/sandbox/registry-gateway/admit-package.mjs "$private/ui-primitives.tgz" \
            @platform-modules/ui-primitives 0.5.0 "$mirror" http://100.101.104.41:4873 2026-08-05T12:01:34Z
          node modules/sandbox/registry-gateway/admit-package.mjs "$private/ui-tokens.tgz" \
            @platform-modules/ui-tokens 0.2.0 "$mirror" http://100.101.104.41:4873 2026-06-25T08:57:32Z
          sudo ip address add 100.101.104.41/32 dev lo
          nohup env REGISTRY_MIRROR="$mirror" REGISTRY_HOST=100.101.104.41 REGISTRY_PORT=4873 \
            node modules/sandbox/registry-gateway/server.mjs \
            >"$RUNNER_TEMP/platform-registry.log" 2>&1 &
          printf '%s\n' "$!" >"$RUNNER_TEMP/platform-registry.pid"
          for attempt in $(seq 1 50); do
            if curl --fail --silent --show-error \
              http://100.101.104.41:4873/%40platform-modules%2Fquery-react \
              --output "$RUNNER_TEMP/platform-registry-response.json"; then
              exit 0
            fi
            sleep 0.1
          done
          exit 1
      - id: build
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a
        with:
          context: .
          file: modules/harness/factory/kubernetes/Containerfile
          network: host
          push: true
          tags: |
            ghcr.io/alexcodeplace/overdeck-agent-sandbox:factory-${{ github.sha }}
            ghcr.io/alexcodeplace/overdeck-agent-sandbox:factory-latest
      - name: Stop immutable registry snapshot
        if: always()
        run: |
          if test -s "$RUNNER_TEMP/platform-registry.pid"; then
            kill "$(<"$RUNNER_TEMP/platform-registry.pid")" 2>/dev/null || true
          fi
          sudo ip address delete 100.101.104.41/32 dev lo 2>/dev/null || true
      - run: echo '### `${{ steps.build.outputs.digest }}`' >> "$GITHUB_STEP_SUMMARY"
