name: Build and Publish Container Image

# Modelled on activity-core/.forgejo/workflows/image.yaml -- the fleet's
# canonical image-publish pattern. Images are built by CI from a tarball of
# the pushed commit, never from a workstation working tree, so the artifact's
# provenance is a forge revision.
#
# `examples/**` is a build-trigger path on purpose: the policy packages are
# COPYed into the image (see Containerfile) and there is no hot reload, so a
# policy change is a new image.

on:
  push:
    branches:
      - main
    paths:
      - ".forgejo/workflows/image.yaml"
      - "Containerfile"
      - "cmd/**"
      - "internal/**"
      - "pkg/**"
      - "third_party/**"
      - "examples/**"
      - "go.mod"
      - "go.sum"
      - "tools/publish-runtime-images.sh"
  workflow_dispatch:
    inputs:
      publish_runtime_rename:
        description: "Publish both packages after the exact new public-package scope is accepted"
        type: boolean
        required: false
        default: false

env:
  REGISTRY: forgejo.coulomb.social
  IMAGE_NAME: coulomb/flex-auth
  DOCKER_HOST: tcp://127.0.0.1:2375

jobs:
  build-and-push:
    runs-on: container-build
    steps:
      - name: Build and push image
        env:
          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
        run: |
          set -eu
          REF="${GITHUB_SHA:?full source revision required}"
          [[ "$REF" =~ ^[a-f0-9]{40}$ ]] || exit 2
          SHORT="${REF:0:7}"
          mkdir -p buildctx "${HOME}/bin"
          wget -qO /tmp/repo.tar.gz \
            "https://forgejo.coulomb.social/${GITHUB_REPOSITORY}/archive/${REF}.tar.gz"
          tar xzf /tmp/repo.tar.gz -C buildctx --strip-components=1
          wget -qO- https://download.docker.com/linux/static/stable/x86_64/docker-27.3.1.tgz \
            | tar xz --strip-components=1 -C "${HOME}/bin" docker/docker
          export PATH="${HOME}/bin:${PATH}"
          echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" -u "${REGISTRY_USER}" --password-stdin
          # Pushes keep the already admitted legacy package. Paired publication
          # is an explicit owner dispatch after the daily red-batch disposition.
          MODE=legacy
          if [ "${{ github.event_name }}" = workflow_dispatch ] && [ "${{ inputs.publish_runtime_rename }}" = true ]; then
            MODE=paired
          fi
          bash buildctx/tools/publish-runtime-images.sh "$REF" "$MODE" buildctx

      - name: Report immutable digest
        run: |
          set -eu
          export PATH="${HOME}/bin:${PATH}"
          IMAGE="${REGISTRY}/${IMAGE_NAME}"
          SHORT="${GITHUB_SHA:0:7}"
          # Legacy package is available on ordinary push; paired digest verification
          # runs in the publisher before an owner can switch any pin.
          docker inspect --format='{{index .RepoDigests 0}}' "${IMAGE}:main-${SHORT}"