name: CI Images

# Publishes the per-PHP-version images that ci.yml and release.yml run inside
# (#187). Nothing else consumes them, so this workflow is the only place the
# registry path is written down.
#
# Triggers:
#   - the Dockerfile or this workflow changing on main, so an edit ships;
#   - the same paths on a pull request, which builds but does not push, so a
#     broken Dockerfile is caught before it reaches main;
#   - workflow_dispatch, to rebuild on demand;
#   - weekly, so PHP patch releases and Alpine security updates land without
#     anyone remembering to ask.

on:
  push:
    branches:
      - main
    paths:
      - '.gitea/ci/Dockerfile'
      - '.gitea/workflows/ci-images.yml'
  pull_request:
    paths:
      - '.gitea/ci/Dockerfile'
      - '.gitea/workflows/ci-images.yml'
  schedule:
    - cron: '17 4 * * 1'
  workflow_dispatch:

env:
  # The instance ROOT_URL host — the container registry lives on the same host.
  REGISTRY: git.unsupervised.ca
  IMAGE: unsupervised/ci-php

jobs:
  build:
    name: Build CI image (PHP ${{ matrix.php }})
    runs-on: ubuntu-latest
    strategy:
      # One version failing should not hide whether the others built.
      fail-fast: false
      matrix:
        # Keep in step with the test matrix in ci.yml.
        php:
          - '8.1'
          - '8.2'
          - '8.3'
          - '8.5'
    steps:
      - uses: actions/checkout@v4

      # The images are built natively, so they carry the runner's
      # architecture only. Fine while every runner is arm64; if a runner of a
      # different architecture ever joins the pool it will overwrite these
      # tags with its own arch and the others will fail to pull.
      - name: Check Docker is available
        run: |
          if ! docker info >/dev/null 2>&1; then
            echo "No usable Docker daemon in the job container." >&2
            echo "act_runner needs container.docker_host set (or left empty to autodetect)." >&2
            exit 1
          fi
          docker version --format 'client {{.Client.Version}} / server {{.Server.Version}} / arch {{.Server.Arch}}'

      # secrets.GITHUB_TOKEN is the Actions task token and can write packages
      # for the repository owner. REGISTRY_TOKEN is an escape hatch: set it to
      # a PAT with package:write if the task token is ever refused.
      - name: Log in to the container registry
        if: github.event_name != 'pull_request'
        run: |
          echo "${{ secrets.REGISTRY_TOKEN || secrets.GITHUB_TOKEN }}" \
            | docker login "${REGISTRY}" -u "${{ vars.REGISTRY_USER || github.actor }}" --password-stdin

      - name: Build
        run: |
          docker build \
            --pull \
            --build-arg "PHP_VERSION=${{ matrix.php }}" \
            --tag "${REGISTRY}/${IMAGE}:${{ matrix.php }}" \
            --file .gitea/ci/Dockerfile \
            .gitea/ci

      # Pull requests build only — the tags on the registry are what the other
      # workflows run inside, so only main and a manual dispatch move them.
      - name: Push
        if: github.event_name != 'pull_request'
        run: |
          image="${REGISTRY}/${IMAGE}:${{ matrix.php }}"
          docker push "${image}"
          echo "Published ${image}"

      - name: Log out
        if: always() && github.event_name != 'pull_request'
        run: docker logout "${REGISTRY}" || true