# Generated by ore workflow generate — layer: release
# Source: .ontoref/ontology/workflow.ncl  — distributions catalog
# Do not edit manually — regenerate with: ore workflow generate --layer release
#
# Daemon image is an OPTIONAL accelerator per ADR-029. Bundles install a
# daemon-less CLI; the image serves container deployments.
# CI prereqs: per-arch nickel under dist/nickel/<triple>/nickel; cosign key in
# $COSIGN_KEY and release upload token in $RELEASE_TOKEN from the src-vault.

when:
  event: [tag, manual]

steps:
  build-release-musl-x86:
    image: rust:latest
    commands:
      - cargo install cross --locked
      - cross build --target x86_64-unknown-linux-musl --release

  build-release-musl-arm64:
    image: rust:latest
    commands:
      - cargo install cross --locked
      - cross build --target aarch64-unknown-linux-musl --release

  build-sbom:
    image: rust:latest
    commands:
      - cargo install cargo-sbom --locked
      - cargo sbom > sbom.json

  build-bundle-linux-x86:
    image: rust:latest
    depends_on: ["build-release-musl-x86"]
    commands:
      - cargo install nu --locked
      - nu install/assemble-bundle.nu --target x86_64-unknown-linux-musl --version "${CI_COMMIT_TAG}" --nickel dist/nickel/x86_64-unknown-linux-musl/nickel

  build-bundle-linux-arm64:
    image: rust:latest
    depends_on: ["build-release-musl-arm64"]
    commands:
      - cargo install nu --locked
      - nu install/assemble-bundle.nu --target aarch64-unknown-linux-musl --version "${CI_COMMIT_TAG}" --nickel dist/nickel/aarch64-unknown-linux-musl/nickel

  smoke-bundle:
    image: rust:latest
    depends_on: ["build-release-musl-x86"]
    commands:
      - cargo install nu --locked
      - nu install/assemble-bundle.nu smoke --target x86_64-unknown-linux-musl

  dist-oci-image:
    image: quay.io/buildah/stable
    depends_on: ["smoke-bundle", "build-release-musl-x86", "build-release-musl-arm64"]
    commands:
      - buildah from --name ont-amd64 --arch amd64 alpine:3.21
      - buildah copy ont-amd64 target/x86_64-unknown-linux-musl/release/ontoref-daemon /usr/local/bin/ontoref-daemon
      - buildah copy ont-amd64 dist/nickel/x86_64-unknown-linux-musl/nickel /usr/local/bin/nickel
      - buildah copy ont-amd64 .ontoref/reflection /opt/ontoref/reflection
      - buildah copy ont-amd64 ontology /opt/ontoref/ontology
      - buildah config --port 7891 --env ONTOREF_ROOT=/opt/ontoref --env NICKEL_IMPORT_PATH=/opt/ontoref/ontology/schemas:/opt/ontoref/ontology --entrypoint '["ontoref-daemon"]' ont-amd64
      - buildah commit --manifest ontoref-daemon ont-amd64 reg.librecloud.online/ontoref/ontoref-daemon:"${CI_COMMIT_TAG}"-amd64
      - buildah from --name ont-arm64 --arch arm64 alpine:3.21
      - buildah copy ont-arm64 target/aarch64-unknown-linux-musl/release/ontoref-daemon /usr/local/bin/ontoref-daemon
      - buildah copy ont-arm64 dist/nickel/aarch64-unknown-linux-musl/nickel /usr/local/bin/nickel
      - buildah copy ont-arm64 .ontoref/reflection /opt/ontoref/reflection
      - buildah copy ont-arm64 ontology /opt/ontoref/ontology
      - buildah config --port 7891 --env ONTOREF_ROOT=/opt/ontoref --env NICKEL_IMPORT_PATH=/opt/ontoref/ontology/schemas:/opt/ontoref/ontology --entrypoint '["ontoref-daemon"]' ont-arm64
      - buildah commit --manifest ontoref-daemon ont-arm64 reg.librecloud.online/ontoref/ontoref-daemon:"${CI_COMMIT_TAG}"-arm64
      - buildah manifest push --all ontoref-daemon docker://reg.librecloud.online/ontoref/ontoref-daemon:"${CI_COMMIT_TAG}"
      - cosign sign --key "$COSIGN_KEY" --yes reg.librecloud.online/ontoref/ontoref-daemon:"${CI_COMMIT_TAG}"
      - cosign attest --predicate sbom.json --type spdxjson --key "$COSIGN_KEY" --yes reg.librecloud.online/ontoref/ontoref-daemon:"${CI_COMMIT_TAG}"

  dist-oci-bundle-linux-x86:
    image: ghcr.io/oras-project/oras:v1.2.0
    depends_on: ["smoke-bundle", "build-bundle-linux-x86"]
    commands:
      - cd dist
      - oras push reg.librecloud.online/ontoref/dist:"${CI_COMMIT_TAG}"-linux-amd64 ontoref-linux-amd64.tar.gz:application/vnd.ontoref.bundle.tar+gzip ontoref-linux-amd64.tar.gz.sha256:text/plain

  dist-oci-bundle-linux-arm64:
    image: ghcr.io/oras-project/oras:v1.2.0
    depends_on: ["smoke-bundle", "build-bundle-linux-arm64"]
    commands:
      - cd dist
      - oras push reg.librecloud.online/ontoref/dist:"${CI_COMMIT_TAG}"-linux-arm64 ontoref-linux-arm64.tar.gz:application/vnd.ontoref.bundle.tar+gzip ontoref-linux-arm64.tar.gz.sha256:text/plain

  dist-installer:
    image: curlimages/curl:latest
    depends_on: ["smoke-bundle"]
    commands:
      # Publish the rendered installer to the plain HTTPS asset endpoint.
      # PUT target and auth are deployment-specific; https://get.librecloud.online/ontoref/install.sh is the
      # canonical URL users curl. Replace with your release-asset upload.
      - 'curl -fsSL --fail -T install/install.sh -H "Authorization: Bearer $RELEASE_TOKEN" https://get.librecloud.online/ontoref/install.sh'