name: Run app

on:
  workflow_dispatch:
    inputs:
      release:
        description: "Published full commit SHA or Git tag (not a branch or latest)"
        required: true
        type: string

jobs:
  request:
    name: Run selected image over restricted SSH
    # Execute trusted control-plane code, never a user-selected release workflow.
    if: github.ref == 'refs/heads/master'
    runs-on: python-ci
    env:
      REGISTRY: gitea.vandeplanque.com
      IMAGE_REPOSITORY: tonio/car-tracker
      DOCKER_CONFIG: /tmp/car-tracker-docker-auth
      RELEASE: ${{ github.event.inputs.release }}
    steps:
      - name: Check out trusted master workflow revision
        uses: https://github.com/actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
        with:
          persist-credentials: false
          fetch-depth: 0

      - name: Install Docker client
        run: sh ops/ci/install-docker-cli.sh

      - name: Install Python
        uses: https://github.com/astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e
        with:
          version: "0.9.3"
          python-version: "3.13"
          enable-cache: false
          add-problem-matchers: false
          github-token: ""

      - name: Authenticate to registry
        env:
          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
        run: |
          set -eu
          test -n "$REGISTRY_USER" && test -n "$REGISTRY_TOKEN"
          umask 077
          mkdir -p "$DOCKER_CONFIG"
          printf '%s' "$REGISTRY_TOKEN" | docker login "$REGISTRY" --username "$REGISTRY_USER" --password-stdin

      - name: Install SSH client
        run: |
          apt-get update
          apt-get install -y --no-install-recommends openssh-client

      - name: Run selected release on homelab
        env:
          SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
          SSH_KNOWN_HOSTS: ${{ secrets.SSH_KNOWN_HOSTS }}
          GITHUB_RUN_ID: ${{ github.run_id }}
        run: uv run --no-project --python 3.13 python ops/ssh/run.py

      - name: Remove job registry credentials
        if: always()
        run: rm -rf /tmp/car-tracker-docker-auth