name: Rebuild Docker images

on:
  workflow_dispatch:

concurrency:
  group: rebuild-docker-images
  cancel-in-progress: false

jobs:
  rebuild-and-push:
    runs-on: ubuntu-latest
    env:
      REGISTRY: docker.dcglab.co.uk
      IMAGE_BASE: docker.dcglab.co.uk/public/kb
      REGISTRY_USERNAME: ${{ secrets.DOCKER_DCGLAB_CI_USERNAME }}
      REGISTRY_PASSWORD: ${{ secrets.DOCKER_DCGLAB_CI_PASSWORD }}
    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Log in to registry
        shell: bash
        run: |
          set -euo pipefail
          test -n "$REGISTRY_USERNAME" || { echo "DOCKER_DCGLAB_CI_USERNAME is not available" >&2; exit 1; }
          test -n "$REGISTRY_PASSWORD" || { echo "DOCKER_DCGLAB_CI_PASSWORD is not available" >&2; exit 1; }
          printf '%s' "$REGISTRY_PASSWORD" | docker login "$REGISTRY" --username "$REGISTRY_USERNAME" --password-stdin

      - name: Build all images from scratch
        shell: bash
        run: |
          set -euo pipefail
          version="$(tr -d '[:space:]' < engine/VERSION)"

          docker build --pull --no-cache --provenance=false --sbom=false \
            -t "$IMAGE_BASE/engine:v${version}-nvidia" \
            -t "$IMAGE_BASE/engine:latest-nvidia" \
            -f engine/Dockerfile.nvidia engine

          docker build --pull --no-cache --provenance=false --sbom=false \
            -t "$IMAGE_BASE/engine:v${version}-cpu" \
            -t "$IMAGE_BASE/engine:latest-cpu" \
            -f engine/Dockerfile.cpu engine

          docker build --pull --no-cache --provenance=false --sbom=false \
            -t "$IMAGE_BASE/mcp:v${version}" \
            -t "$IMAGE_BASE/mcp:latest" \
            -f mcp/Dockerfile mcp

      - name: Push and verify all tags
        shell: bash
        run: |
          set -euo pipefail
          version="$(tr -d '[:space:]' < engine/VERSION)"
          images=(
            "$IMAGE_BASE/engine:v${version}-nvidia"
            "$IMAGE_BASE/engine:latest-nvidia"
            "$IMAGE_BASE/engine:v${version}-cpu"
            "$IMAGE_BASE/engine:latest-cpu"
            "$IMAGE_BASE/mcp:v${version}"
            "$IMAGE_BASE/mcp:latest"
          )

          push_image() {
            local image="$1"
            local attempt
            for attempt in 1 2 3 4 5; do
              docker push "$image" && return 0
              if [[ "$attempt" -eq 5 ]]; then
                echo "Failed to push $image after $attempt attempts" >&2
                return 1
              fi
              sleep 10
            done
          }

          for image in "${images[@]}"; do
            push_image "$image"
            docker manifest inspect "$image" >/dev/null
          done