name: Docker
# Builds the frontend for the HOMELAB instance and pushes it to this Gitea's
# registry.
#
# Read the build args before changing anything: Vite inlines import.meta.env at
# BUILD time, so VITE_API_URL is baked into the bundle and an image is tied to
# one API. The GitHub build bakes https://api.t4t-gateway.com -- running that
# image here would serve a UI at t4tgw.ffaerber.duckdns.org that talks to the
# VPS, so a test signup would create a real account on production. This build
# bakes the homelab API instead, which is the whole reason the two instances can
# run side by side and mean anything.
#
# VITE_GOOGLE_CLIENT_ID comes from a repo secret; unset, Google sign-in is the
# only thing that breaks, and the rest of the instance still exercises.
on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

env:
  HOMELAB_API_URL: https://t4tgw-api.ffaerber.duckdns.org

# Gitea derives the automatic token's scopes from this block; without it the
# token cannot write packages and `docker login` to this instance's registry
# fails with a bare "unauthorized".
permissions:
  contents: read
  packages: write

jobs:
  build:
    runs-on: ci-runner
    steps:
      - uses: actions/checkout@v4

      - name: Build
        run: |
          set -eu
          SHA=$(echo "${{ github.sha }}" | cut -c1-7)
          echo "IMAGE=git.ffaerber.duckdns.org/token-for-token/hosted-gateway-frontend" >> "$GITHUB_ENV"
          echo "SHA=$SHA" >> "$GITHUB_ENV"
          docker build \
            --build-arg VITE_API_URL="$HOMELAB_API_URL" \
            --build-arg VITE_GOOGLE_CLIENT_ID="${{ secrets.VITE_GOOGLE_CLIENT_ID }}" \
            --build-arg VITE_COMMIT_SHA=${{ github.sha }} \
            -t "git.ffaerber.duckdns.org/token-for-token/hosted-gateway-frontend:$SHA" .

      - name: Push
        if: github.event_name != 'pull_request'
        run: |
          set -eu
          echo "${{ secrets.GITEA_TOKEN }}" | docker login git.ffaerber.duckdns.org -u "${{ github.actor }}" --password-stdin
          docker tag "$IMAGE:$SHA" "$IMAGE:latest"
          docker push "$IMAGE:$SHA"
          docker push "$IMAGE:latest"
          docker logout git.ffaerber.duckdns.org
          {
            echo "### Pushed"
            echo
            echo '```'
            echo "$IMAGE:$SHA"
            echo '```'
            echo
            echo "API baked in: $HOMELAB_API_URL"
          } >> "$GITHUB_STEP_SUMMARY"