core-backfill-runner-image.yml

name: Backfill CI runner image

on:
  workflow_dispatch:
    inputs:
      version:
        description: Existing LabWired Core release tag to package (for example v0.18.0).
        required: true
        type: string

permissions:
  contents: read
  packages: write

jobs:
  publish:
    name: Publish an existing release runner image
    runs-on: ubuntu-latest
    steps:
      - name: Validate release tag
        shell: bash
        env:
          LABWIRED_VERSION: ${{ inputs.version }}
        run: |
          set -euo pipefail
          version="$LABWIRED_VERSION"
          if ! [[ "$version" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "::error::version must be an existing vMAJOR.MINOR.PATCH release tag."
            exit 1
          fi

      - name: Check out the exact released source
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.version }}
          path: source

      - name: Check out the current packaging workflow
        uses: actions/checkout@v4
        with:
          path: release-tools

      - name: Resolve released source revision
        id: source
        shell: bash
        run: echo "revision=$(git -C source rev-parse HEAD)" >> "$GITHUB_OUTPUT"

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and publish the immutable release runner image
        uses: docker/build-push-action@v6
        with:
          context: ./source
          file: ./release-tools/Dockerfile.ci
          push: true
          platforms: linux/amd64
          tags: ghcr.io/w1ne/labwired:${{ inputs.version }}
          build-args: |
            VERSION=${{ inputs.version }}
            REVISION=${{ steps.source.outputs.revision }}

      - name: Pull the runner image anonymously
        shell: bash
        run: |
          set -euo pipefail
          docker logout ghcr.io || true
          if ! docker pull "ghcr.io/w1ne/labwired:${{ inputs.version }}"; then
            echo "::error::Unable to anonymously pull the released runner image. Make the GHCR package public in GitHub Packages, then re-run this workflow."
            exit 1
          fi

      - name: Run the backfilled runner image
        shell: bash
        run: |
          set -euo pipefail
          docker run --rm \
            --user "$(id -u):$(id -g)" \
            --volume "$GITHUB_WORKSPACE/source:/workspace" \
            --workdir /workspace \
            "ghcr.io/w1ne/labwired:${{ inputs.version }}" \
            test \
            --script examples/ci/dummy-max-steps.yaml \
            --output-dir out/backfill-runner-smoke \
            --no-uart-stdout
          test -s source/out/backfill-runner-smoke/result.json