env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

name: Build and publish windmill for RHEL9
on: workflow_dispatch

permissions: write-all

jobs:
  build_ee:
    runs-on: ubicloud-standard-4
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Read EE repo commit hash
        run: |
          echo "ee_repo_ref=$(cat ./backend/ee-repo-ref.txt)" >> "$GITHUB_ENV"

      - uses: actions/checkout@v4
        with:
          repository: windmill-labs/windmill-ee-private
          path: ./windmill-ee-private
          ref: ${{ env.ee_repo_ref }}
          token: ${{ secrets.WINDMILL_EE_PRIVATE_ACCESS }}
          fetch-depth: 0

      - uses: depot/setup-action@v1

      - name: Docker meta
        id: meta-ee-public
        uses: docker/metadata-action@v5
        with:
          images: |
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee-rhel9
          flavor: |
            latest=false
          tags: |
            type=sha

      - name: Login to registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Substitute EE code
        run: |
          ./backend/substitute_ee_code.sh --copy --dir ./windmill-ee-private

      - name: Copy RHEL9 Dockerfile
        run: |
          cp ./docker/RHEL9/Dockerfile ./Dockerfile

      - name: Build and push EE (multi-arch)
        uses: depot/build-push-action@v1
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          build-args: |
            features=ee_rhel
          secrets: |
            rh_username=${{ secrets.RH_USERNAME }}
            rh_password=${{ secrets.RH_PASSWORD }}
          tags: |
            ${{ steps.meta-ee-public.outputs.tags }}
          labels: |
            ${{ steps.meta-ee-public.outputs.labels }}
            org.opencontainers.image.licenses=Windmill-Enterprise-License

      - name: Install crane
        uses: imjasonh/setup-crane@v0.4

      - name: Extract binaries with crane
        run: |
          mkdir -p extracted

          # Extract arm64 binary (include deps/ for hard link resolution)
          mkdir -p /tmp/arm64
          crane export --platform linux/arm64 ${{ steps.meta-ee-public.outputs.tags }} - \
            | tar -xf - -C /tmp/arm64 windmill/target/release/ usr/src/app/libwindmill_duckdb_ffi_internal.so
          cp /tmp/arm64/windmill/target/release/windmill extracted/windmill-ee-arm64-rhel9
          cp /tmp/arm64/usr/src/app/libwindmill_duckdb_ffi_internal.so extracted/libwindmill_duckdb_ffi_internal-arm64.so
          rm -rf /tmp/arm64

          # Extract amd64 binary
          mkdir -p /tmp/amd64
          crane export --platform linux/amd64 ${{ steps.meta-ee-public.outputs.tags }} - \
            | tar -xf - -C /tmp/amd64 windmill/target/release/ usr/src/app/libwindmill_duckdb_ffi_internal.so
          cp /tmp/amd64/windmill/target/release/windmill extracted/windmill-ee-amd64-rhel9
          cp /tmp/amd64/usr/src/app/libwindmill_duckdb_ffi_internal.so extracted/libwindmill_duckdb_ffi_internal-amd64.so
          rm -rf /tmp/amd64

      - uses: actions/upload-artifact@v4
        with:
          name: RHEL9-arm64 build
          path: extracted/windmill-ee-arm64-rhel9

      - uses: actions/upload-artifact@v4
        with:
          name: RHEL9-amd64 build
          path: extracted/windmill-ee-amd64-rhel9

      - uses: actions/upload-artifact@v4
        with:
          name: RHEL9-arm64 dynamic libraries build
          path: extracted/libwindmill_duckdb_ffi_internal-arm64.so

      - uses: actions/upload-artifact@v4
        with:
          name: RHEL9-amd64 dynamic libraries build
          path: extracted/libwindmill_duckdb_ffi_internal-amd64.so