name: Docker
# Builds the hosted-gateway image for the homelab instance and pushes it to this
# Gitea's own registry. Deliberately build-only: the GitHub workflow this
# replaces also SSHed into the Hostinger VPS and redeployed it, which is the
# machine being retired. Here the image is deployed the way everything else in
# the homelab is -- a PR bumping the tag in ffaerber/homelab's docker-compose.yml
# -- so a deploy is a reviewed commit rather than a side effect of a push.
on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

jobs:
  build:
    # The homelab runner (a container on pluto, sharing the host docker daemon).
    runs-on: ci-runner
    steps:
      - uses: actions/checkout@v4

      # Plain docker rather than buildx: the runner already has the host daemon
      # on a mounted socket, and the gha cache backend buildx wants does not
      # exist here.
      - name: Build
        run: |
          set -eu
          SHA=$(echo "${{ github.sha }}" | cut -c1-7)
          echo "IMAGE=git.ffaerber.duckdns.org/token-for-token/hosted-gateway" >> "$GITHUB_ENV"
          echo "SHA=$SHA" >> "$GITHUB_ENV"
          docker build --build-arg COMMIT_SHA=${{ github.sha }} \
            -t "git.ffaerber.duckdns.org/token-for-token/hosted-gateway:$SHA" .

      # Pull requests build to prove the Dockerfile still works, and stop there.
      - name: Push
        if: github.event_name != 'pull_request'
        run: |
          set -eu
          # Not the automatic Actions token: this Gitea's package registry rejects
          # it (docker login returns a bare "unauthorized"), with or without a
          # permissions: packages: write block. REGISTRY_TOKEN is an org secret
          # holding a personal access token scoped to write:package only.
          if [ -z "${{ secrets.REGISTRY_TOKEN }}" ]; then
            echo "REGISTRY_TOKEN is not set — create a token with the write:package scope" >&2
            echo "and add it as an org secret on token-for-token. The image built fine;" >&2
            echo "only the push needs it." >&2
            exit 1
          fi
          echo "${{ secrets.REGISTRY_TOKEN }}" | docker login git.ffaerber.duckdns.org -u "${{ vars.REGISTRY_USER || 'ffaerber' }}" --password-stdin
          docker tag "$IMAGE:$SHA" "$IMAGE:latest"
          docker push "$IMAGE:$SHA"
          docker push "$IMAGE:latest"
          docker logout git.ffaerber.duckdns.org
          {
            echo "### Pushed"
            echo
            echo '```'
            echo "$IMAGE:$SHA"
            echo '```'
          } >> "$GITHUB_STEP_SUMMARY"