name: build-and-push
run-name: "build-and-push · ${{ gitea.ref_name }}"
# Builds the homepage image and pushes it to this Gitea instance's container
# registry as git.ffaerber.duckdns.org/ffaerber/homepage:latest on every push to main.
on:
  push:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read
  packages: write

env:
  IMAGE: git.ffaerber.duckdns.org/ffaerber/homepage

jobs:
  build-and-push:
    runs-on: ci-runner
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to container registry
        uses: docker/login-action@v3
        with:
          registry: git.ffaerber.duckdns.org
          username: ffaerber
          password: ${{ secrets.REGISTRY_TOKEN }}

      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: |
            ${{ env.IMAGE }}:latest
            ${{ env.IMAGE }}:${{ gitea.sha }}
          provenance: false

      # Hand off to the homelab stack: dispatch its deploy workflow so the swarm re-resolves
      # :latest and rolls the homepage service. Deterministic — no agent involved. TOKEN_DEPLOY
      # is the `deploy` bot (write:repository, write collaborator on ffaerber/homelab only).
      - name: Trigger homelab deploy
        env:
          TD: ${{ secrets.TOKEN_DEPLOY }}
        run: |
          [ -n "$TD" ] || { echo "TOKEN_DEPLOY not set - skipping deploy dispatch"; exit 0; }
          curl -sS -o /dev/null -w "homelab deploy dispatch -> HTTP %{http_code}\n" -X POST \
            -H "Authorization: token $TD" -H "Content-Type: application/json" \
            "${GITHUB_SERVER_URL}/api/v1/repos/ffaerber/homelab/actions/workflows/deploy.yml/dispatches" \
            -d '{"ref":"main"}'