# Skeleton only. Do not create Studio-Saelix/sencho-hardened until explicit authorization is given.
name: Publish Hardened Build

on:
  workflow_dispatch:
    inputs:
      source_ref:
        description: Immutable source commit SHA
        required: true
        type: string
      base_image_digest:
        description: Immutable base-image digest
        required: true
        type: string
      policy_revision:
        description: Immutable scanner and OpenVEX policy revision
        required: true
        type: string

permissions:
  contents: read

jobs:
  validate-inputs:
    runs-on: ubuntu-24.04
    outputs:
      source_ref: ${{ steps.inputs.outputs.source_ref }}
      base_image_digest: ${{ steps.inputs.outputs.base_image_digest }}
      policy_revision: ${{ steps.inputs.outputs.policy_revision }}
    steps:
      # Replace every placeholder with a verified, full commit SHA before enabling.
      - uses: actions/checkout@<FULL_40_CHARACTER_COMMIT_SHA>
        with:
          ref: ${{ inputs.source_ref }}
          persist-credentials: false
      - id: inputs
        shell: bash
        run: |
          [[ "${{ inputs.source_ref }}" =~ ^[0-9a-f]{40}$ ]]
          [[ "${{ inputs.base_image_digest }}" =~ ^sha256:[0-9a-f]{64}$ ]]
          [[ "${{ inputs.policy_revision }}" =~ ^[0-9a-f]{40}$ ]]
          printf 'source_ref=%s\n' "${{ inputs.source_ref }}" >> "$GITHUB_OUTPUT"
          printf 'base_image_digest=%s\n' "${{ inputs.base_image_digest }}" >> "$GITHUB_OUTPUT"
          printf 'policy_revision=%s\n' "${{ inputs.policy_revision }}" >> "$GITHUB_OUTPUT"

  build-and-assess:
    needs: validate-inputs
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      id-token: write
    strategy:
      fail-fast: false
      matrix:
        platform: [linux/amd64, linux/arm64]
    steps:
      - uses: actions/checkout@<FULL_40_CHARACTER_COMMIT_SHA>
        with:
          ref: ${{ needs.validate-inputs.outputs.source_ref }}
          persist-credentials: false
      # TODO: install pinned Buildx and build from the source ref, lockfile,
      # base-image digest, and platform. Export an OCI layout for scanning.
      - name: Build immutable platform image
        run: exit 1 # TODO: replace with a pinned Buildx invocation
      # TODO: run a pinned Trivy image scan and evaluate the approved OpenVEX file.
      - name: Gate Trivy and OpenVEX findings
        run: exit 1 # TODO: fail exploitable critical or high findings
      # TODO: generate SPDX and CycloneDX SBOMs plus SLSA provenance.
      - name: Generate supply-chain attestations
        run: exit 1 # TODO: replace with pinned tooling
      # TODO: sign the immutable platform digest with Cosign keyless OIDC.
      - name: Sign platform digest
        run: exit 1 # TODO: replace with pinned Cosign tooling

  publish-manifest:
    needs: build-and-assess
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      packages: write
      id-token: write
      attestations: write
    environment: hardened-production
    steps:
      # TODO: assemble the approved multi-architecture manifest, attach SBOM
      # and provenance, sign it, then publish only this immutable target:
      # ghcr.io/studio-saelix/sencho-hardened
      - name: Publish approved manifest
        run: exit 1 # TODO: replace after explicit authorization