name: AgentBeats Branch Images

on:
  push:
    branches:
      - codex/skillsbench-agentbeats-v1-1-update
    paths:
      - 'integrations/agentbeats/worker/Dockerfile'
      - 'integrations/agentbeats/green_agent/Dockerfile'
      - 'integrations/agentbeats/agent_under_test/Dockerfile'
      - 'integrations/agentbeats/task_sets/**'
      - 'skillsbench_agentbeats/**'
      - 'tasks/**'
      - 'pyproject.toml'
      - 'uv.lock'
      - 'README.md'
  workflow_dispatch:
    inputs:
      image_tag:
        description: "Tag to publish for branch runtime images"
        required: true
        type: string
      push:
        description: "Push images to GHCR"
        default: true
        type: boolean

permissions:
  contents: read

jobs:
  publish:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - name: Resolve image publish config
        id: config
        shell: bash
        env:
          EVENT_NAME: ${{ github.event_name }}
          INPUT_IMAGE_TAG: ${{ inputs.image_tag || '' }}
          INPUT_PUSH: ${{ inputs.push }}
        run: |
          set -euo pipefail
          if [[ "${EVENT_NAME}" == "workflow_dispatch" ]]; then
            image_tag="${INPUT_IMAGE_TAG}"
            push="${INPUT_PUSH}"
          else
            image_tag="skillsbench-v1.1-${GITHUB_SHA}"
            push="true"
          fi
          if [[ -z "${image_tag}" ]]; then
            echo "image_tag is required" >&2
            exit 1
          fi
          if [[ ! "${push}" =~ ^(true|false)$ ]]; then
            echo "push must be true or false" >&2
            exit 1
          fi
          echo "image_tag=${image_tag}" >> "$GITHUB_OUTPUT"
          echo "push=${push}" >> "$GITHUB_OUTPUT"

      - name: Checkout
        uses: actions/checkout@v6

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GHCR
        if: steps.config.outputs.push == 'true'
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GHCR_TOKEN || secrets.GITHUB_TOKEN }}

      - name: Build and publish worker image
        id: worker
        uses: docker/build-push-action@v6
        with:
          context: .
          file: integrations/agentbeats/worker/Dockerfile
          platforms: linux/amd64
          push: ${{ steps.config.outputs.push }}
          tags: ghcr.io/benchflow-ai/skillsbench-agentbeats-worker:${{ steps.config.outputs.image_tag }}

      - name: Build and publish green image
        id: green
        uses: docker/build-push-action@v6
        with:
          context: .
          file: integrations/agentbeats/green_agent/Dockerfile
          platforms: linux/amd64
          push: ${{ steps.config.outputs.push }}
          tags: ghcr.io/benchflow-ai/skillsbench-agentbeats-green:${{ steps.config.outputs.image_tag }}

      - name: Build and publish purple image
        id: purple
        uses: docker/build-push-action@v6
        with:
          context: .
          file: integrations/agentbeats/agent_under_test/Dockerfile
          platforms: linux/amd64
          push: ${{ steps.config.outputs.push }}
          tags: ghcr.io/benchflow-ai/skillsbench-agentbeats-purple:${{ steps.config.outputs.image_tag }}

      - name: Verify published image refs
        if: steps.config.outputs.push == 'true'
        shell: bash
        run: |
          set -euo pipefail
          for image in \
            "ghcr.io/benchflow-ai/skillsbench-agentbeats-worker@${{ steps.worker.outputs.digest }}" \
            "ghcr.io/benchflow-ai/skillsbench-agentbeats-green@${{ steps.green.outputs.digest }}" \
            "ghcr.io/benchflow-ai/skillsbench-agentbeats-purple@${{ steps.purple.outputs.digest }}"; do
            docker buildx imagetools inspect "${image}" >/dev/null
          done

      - name: Write image evidence artifact
        if: steps.config.outputs.push == 'true'
        shell: bash
        run: |
          set -euo pipefail
          jq -n \
            --arg source_revision "${GITHUB_SHA}" \
            --arg image_tag "${{ steps.config.outputs.image_tag }}" \
            --arg worker "ghcr.io/benchflow-ai/skillsbench-agentbeats-worker@${{ steps.worker.outputs.digest }}" \
            --arg green "ghcr.io/benchflow-ai/skillsbench-agentbeats-green@${{ steps.green.outputs.digest }}" \
            --arg purple "ghcr.io/benchflow-ai/skillsbench-agentbeats-purple@${{ steps.purple.outputs.digest }}" \
            '{source_revision: $source_revision, image_tag: $image_tag, images: {worker: $worker, green: $green, purple: $purple}}' \
            > agentbeats-branch-image-digests.json

      - uses: actions/upload-artifact@v4
        if: steps.config.outputs.push == 'true'
        with:
          name: agentbeats-branch-image-digests
          path: agentbeats-branch-image-digests.json

      - name: Write image summary
        run: |
          {
            echo "## AgentBeats branch image digests"
            echo
            echo "- image tag: ${{ steps.config.outputs.image_tag }}"
            echo "- worker: ghcr.io/benchflow-ai/skillsbench-agentbeats-worker@${{ steps.worker.outputs.digest }}"
            echo "- green: ghcr.io/benchflow-ai/skillsbench-agentbeats-green@${{ steps.green.outputs.digest }}"
            echo "- purple: ghcr.io/benchflow-ai/skillsbench-agentbeats-purple@${{ steps.purple.outputs.digest }}"
          } >> "$GITHUB_STEP_SUMMARY"