name: Setup build environment
description: >
  Builds the mattermost-build-server images if they don't yet exist on Docker
  Hub (e.g. during a Go or Node version bump), and uploads them as artifacts
  for downstream jobs. Run once per workflow before any build or test jobs.

inputs:
  build-server-tag:
    description: "Build image tag, from server/build/buildenv-tag.sh (e.g. go1.26.3-node24.11.1)"
    required: true
  dockerfile:
    description: "Path to Dockerfile.buildenv (relative to workspace root)"
    required: false
    default: "server/build/Dockerfile.buildenv"
  dockerfile-fips:
    description: "Path to Dockerfile.buildenv-fips (relative to workspace root)"
    required: false
    default: "server/build/Dockerfile.buildenv-fips"

runs:
  using: composite
  steps:
    - name: Set constants
      id: constants
      shell: bash
      run: |
        {
          echo "image=mattermost/mattermost-build-server"
          echo "artifact=buildenv-image"
          echo "fips-image=mattermost/mattermost-build-server-fips"
          echo "fips-artifact=buildenv-fips-image"
          echo "tmpdir=/tmp/buildenv-save"
        } >> "${GITHUB_OUTPUT}"
    # ── Regular ────────────────────────────────────────────────────────
    - name: Resolve regular image
      id: resolve
      shell: bash
      env:
        BUILDENV_IMAGE: ${{ steps.constants.outputs.image }}
        BUILDENV_TAG: ${{ inputs.build-server-tag }}
      run: |
        docker manifest inspect "${BUILDENV_IMAGE}:${BUILDENV_TAG}" > /dev/null 2>&1 || \
          echo "needs-build=true" >> "${GITHUB_OUTPUT}"
    - name: Build regular image
      if: ${{ steps.resolve.outputs.needs-build == 'true' }}
      shell: bash
      env:
        BUILDENV_IMAGE: ${{ steps.constants.outputs.image }}
        BUILDENV_TAG: ${{ inputs.build-server-tag }}
        BUILDENV_DOCKERFILE: ${{ inputs.dockerfile }}
      run: docker build -t "${BUILDENV_IMAGE}:${BUILDENV_TAG}" - < "${BUILDENV_DOCKERFILE}"
    - name: Save and upload regular image
      if: ${{ steps.resolve.outputs.needs-build == 'true' }}
      shell: bash
      env:
        BUILDENV_IMAGE: ${{ steps.constants.outputs.image }}
        BUILDENV_TAG: ${{ inputs.build-server-tag }}
        BUILDENV_TMPDIR: ${{ steps.constants.outputs.tmpdir }}
      run: |
        mkdir -p "${BUILDENV_TMPDIR}"
        docker save "${BUILDENV_IMAGE}:${BUILDENV_TAG}" | gzip > "${BUILDENV_TMPDIR}/image.tar.gz"
    - name: Upload regular image artifact
      if: ${{ steps.resolve.outputs.needs-build == 'true' }}
      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
      with:
        name: ${{ steps.constants.outputs.artifact }}
        path: ${{ steps.constants.outputs.tmpdir }}/image.tar.gz
        retention-days: 1
    # ── FIPS (skipped on fork PRs) ─────────────────────────────────────
    - name: Docker Hub login
      if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
      uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
      with:
        username: ${{ env.DOCKERHUB_USERNAME }}
        password: ${{ env.DOCKERHUB_TOKEN }}
    - name: Setup Chainctl
      if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
      uses: chainguard-dev/setup-chainctl@c125f765e82b09a42af3185f3214465314d75c5d # v0.5.0
      with:
        identity: ${{ env.CHAINCTL_IDENTITY }}
    - name: Resolve FIPS image
      id: resolve-fips
      if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
      shell: bash
      env:
        BUILDENV_FIPS_IMAGE: ${{ steps.constants.outputs.fips-image }}
        BUILDENV_TAG: ${{ inputs.build-server-tag }}
      run: |
        docker manifest inspect "${BUILDENV_FIPS_IMAGE}:${BUILDENV_TAG}" > /dev/null 2>&1 || \
          echo "needs-build=true" >> "${GITHUB_OUTPUT}"
    - name: Build FIPS image
      if: ${{ steps.resolve-fips.outputs.needs-build == 'true' }}
      shell: bash
      env:
        BUILDENV_FIPS_IMAGE: ${{ steps.constants.outputs.fips-image }}
        BUILDENV_TAG: ${{ inputs.build-server-tag }}
        BUILDENV_FIPS_DOCKERFILE: ${{ inputs.dockerfile-fips }}
      run: docker build -t "${BUILDENV_FIPS_IMAGE}:${BUILDENV_TAG}" - < "${BUILDENV_FIPS_DOCKERFILE}"
    - name: Save and upload FIPS image
      if: ${{ steps.resolve-fips.outputs.needs-build == 'true' }}
      shell: bash
      env:
        BUILDENV_FIPS_IMAGE: ${{ steps.constants.outputs.fips-image }}
        BUILDENV_TAG: ${{ inputs.build-server-tag }}
        BUILDENV_TMPDIR: ${{ steps.constants.outputs.tmpdir }}
      run: |
        mkdir -p "${BUILDENV_TMPDIR}"
        docker save "${BUILDENV_FIPS_IMAGE}:${BUILDENV_TAG}" | gzip > "${BUILDENV_TMPDIR}/image-fips.tar.gz"
    - name: Upload FIPS image artifact
      if: ${{ steps.resolve-fips.outputs.needs-build == 'true' }}
      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
      with:
        name: ${{ steps.constants.outputs.fips-artifact }}
        path: ${{ steps.constants.outputs.tmpdir }}/image-fips.tar.gz
        retention-days: 1