# 生产 Docker 交付包：仅 tag 触发
# 镜像与包名固定为 v1.1.0（与现网 .env / 部署习惯一致），便于生产升级时不必改镜像标签
# 产物：/root/zkxw-releases/zkxw-docker-deploy-v1.1.0.tar.gz
# 脚本：./scripts/package-docker-deploy.sh

kind: pipeline
type: docker
name: package-prod

concurrency:
  limit: 1

trigger:
  event:
    - tag

clone:
  depth: 1

volumes:
  - name: dockersock
    host:
      path: /var/run/docker.sock
  - name: releases
    host:
      path: /root/zkxw-releases

steps:
  - name: package-docker
    image: docker:27-cli
    # 通过挂载宿主机 docker.sock 构建，无需 privileged（未 trusted 时 privileged 会被拒绝）
    volumes:
      - name: dockersock
        path: /var/run/docker.sock
      - name: releases
        path: /releases
    environment:
      DOCKER_BUILDKIT: '1'
      NODE_MAX_OLD_SPACE_SIZE: '3072'
      NPM_REGISTRY: https://registry.npmmirror.com
      PIP_INDEX_URL: https://mirrors.aliyun.com/pypi/simple/
      PIP_TRUSTED_HOST: mirrors.aliyun.com
      # 固定交付版本（勿改为 DRONE_TAG，生产 .env 使用 v1.1.0）
      ZKXW_DEPLOY_VERSION: v1.1.0
    commands:
      - set -eu
      - apk add --no-cache bash git python3
      - echo "==> git tag=${DRONE_TAG:-none} deploy_version=${ZKXW_DEPLOY_VERSION} commit=${DRONE_COMMIT}"
      - chmod +x scripts/package-docker-deploy.sh scripts/build-docker-images.sh
      - |
        if [ -f /releases/.deploy-docker.env ]; then
          mkdir -p deploy/docker
          cp /releases/.deploy-docker.env deploy/docker/.env
          echo "using /releases/.deploy-docker.env for secret inject"
        fi
      - ./scripts/package-docker-deploy.sh "${ZKXW_DEPLOY_VERSION}"
      - mkdir -p /releases
      - cp -v dist/zkxw-docker-deploy-"${ZKXW_DEPLOY_VERSION}".tar.gz /releases/
      - ls -lh /releases/zkxw-docker-deploy-"${ZKXW_DEPLOY_VERSION}".tar.gz
      - sha256sum /releases/zkxw-docker-deploy-"${ZKXW_DEPLOY_VERSION}".tar.gz