name: Publish

# Builds the application image and pushes it to the Gitea container registry
# as git.unsupervised.ca/unsupervised/antisocial.
#
# Runs on main, and on demand. Pull requests build without pushing, so a
# broken Dockerfile is caught before it can move a published tag.

on:
  push:
    branches:
      - main
  pull_request:
    paths:
      - 'Dockerfile'
      - 'package.json'
      - 'package-lock.json'
      - '.gitea/workflows/publish.yml'
  workflow_dispatch:

env:
  REGISTRY: git.unsupervised.ca
  IMAGE: unsupervised/antisocial

jobs:
  build:
    name: Build and push
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      # Images are built natively, so each carries the architecture of the
      # runner that built it. Every runner in the pool is arm64, which is
      # also what Kallone is. A runner of a different architecture joining
      # would overwrite these tags with its own arch, at which point this
      # needs buildx and a multi-arch manifest.
      - name: Check Docker is available
        run: |
          if ! docker info >/dev/null 2>&1; then
            echo "No usable Docker daemon in the job container." >&2
            echo "act_runner needs container.docker_host set, or left empty to autodetect." >&2
            exit 1
          fi
          docker version --format 'client {{.Client.Version}} / server {{.Server.Version}} / arch {{.Server.Arch}}'

      - name: Work out the tags
        id: tags
        run: echo "sha=sha-$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT"

      # REGISTRY_TOKEN is an organisation secret: a personal access token
      # with the package scope, Read and Write. Gitea's Actions task token is
      # rejected by the container registry (go-gitea/gitea#23642), so this
      # cannot fall back to secrets.GITHUB_TOKEN. The login user must own the
      # token; set the REGISTRY_USER variable if it is not github.actor.
      - name: Log in to the container registry
        if: github.event_name != 'pull_request'
        run: |
          if [ -z "${{ secrets.REGISTRY_TOKEN }}" ]; then
            echo "REGISTRY_TOKEN is not set. The Actions task token cannot push packages." >&2
            exit 1
          fi
          echo "${{ secrets.REGISTRY_TOKEN }}" \
            | docker login "${REGISTRY}" -u "${{ vars.REGISTRY_USER || github.actor }}" --password-stdin

      - name: Build
        run: |
          docker build \
            --pull \
            --tag "${REGISTRY}/${IMAGE}:${{ steps.tags.outputs.sha }}" \
            --tag "${REGISTRY}/${IMAGE}:latest" \
            --file Dockerfile \
            .

      - name: Push
        if: github.event_name != 'pull_request'
        run: |
          docker push "${REGISTRY}/${IMAGE}:${{ steps.tags.outputs.sha }}"
          docker push "${REGISTRY}/${IMAGE}:latest"
          echo "Published ${REGISTRY}/${IMAGE}:${{ steps.tags.outputs.sha }}"

      - name: Log out
        if: always() && github.event_name != 'pull_request'
        run: docker logout "${REGISTRY}" || true