name: Publish sandbox VM kernel

# Publishes the sandbox VM's Linux kernel as a GHCR *package* — an OCI artifact carrying the single
# `vmlinux-arm64` blob — where the macOS app pulls it on first use (ContainerEngine.ensureKernel →
# downloadKernel). Shipping it as a package (not a GitHub *release asset*, which inherits the repo's
# visibility) lets it be made PUBLIC for anonymous pulls while the repo stays private — exactly like
# the `nucleic-sandbox` image. Keep the tag in lockstep with `ProjectSandbox.kernelImage`
# (Sources/NucleicCore/Project.swift).
#
# Manual-only: the kernel is stable and changes rarely. Run from the Actions tab ("Run workflow"),
# supplying the tag. After the FIRST publish, set the package's visibility to Public in
# GitHub → Packages → nucleic-kernel → Package settings (the repo can stay private).

on:
  workflow_dispatch:
    inputs:
      tag:
        description: "Package tag to publish (must match ProjectSandbox.kernelImage)"
        required: true
        default: "6.18.15-186"

jobs:
  publish:
    name: fetch vmlinux-arm64 → GHCR OCI artifact
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4

      - name: Fetch kernel (vmlinux-arm64)
        run: scripts/fetch-kernel.sh   # curl + tar only — writes Resources/vmlinux-arm64

      - name: Resolve package reference
        id: ref
        run: |
          owner="$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')"
          echo "image=ghcr.io/${owner}/nucleic-kernel" >> "$GITHUB_OUTPUT"

      - uses: oras-project/setup-oras@v1

      - name: Log in to GHCR
        run: oras login ghcr.io -u '${{ github.actor }}' -p '${{ secrets.GITHUB_TOKEN }}'

      # Push the raw kernel as a single octet-stream layer so the app pulls one blob (no tar/gzip to
      # unpack). `--artifact-type` keeps GHCR's empty config; the layer is the kernel bytes verbatim.
      - name: Push kernel as an OCI artifact
        working-directory: Resources
        run: |
          oras push \
            "${{ steps.ref.outputs.image }}:${{ github.event.inputs.tag }}" \
            --artifact-type application/vnd.nucleic.kernel \
            vmlinux-arm64:application/octet-stream
