name: Build and Publish identity-provisioner

# Fleet image-publish pattern: build from a tarball of the pushed commit,
# never from a workstation tree. Contract tests run in identity-journeys.yaml
# on the same paths; do not promote a digest if that job failed.

on:
  push:
    branches: [main]
    paths:
      - "identity-provisioner/**"
      - ".forgejo/workflows/identity-provisioner-image.yaml"
  workflow_dispatch:

env:
  REGISTRY: forgejo.coulomb.social
  IMAGE_NAME: coulomb/identity-provisioner
  DOCKER_HOST: tcp://127.0.0.1:2375

jobs:
  build-and-push:
    runs-on: container-build
    steps:
      - name: Build and push image
        env:
          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
        run: |
          set -eu
          REF="${GITHUB_SHA:-main}"
          SHORT="${REF:0:7}"
          mkdir -p buildctx "${HOME}/bin"
          wget -qO /tmp/repo.tar.gz \
            "https://forgejo.coulomb.social/${GITHUB_REPOSITORY}/archive/${SHORT}.tar.gz"
          tar xzf /tmp/repo.tar.gz -C buildctx --strip-components=1
          wget -qO- https://download.docker.com/linux/static/stable/x86_64/docker-27.3.1.tgz \
            | tar xz --strip-components=1 -C "${HOME}/bin" docker/docker
          export PATH="${HOME}/bin:${PATH}"
          echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" -u "${REGISTRY_USER}" --password-stdin
          IMAGE="${REGISTRY}/${IMAGE_NAME}"
          docker build -f buildctx/identity-provisioner/Containerfile \
            -t "${IMAGE}:latest" -t "${IMAGE}:main-${SHORT}" \
            buildctx/identity-provisioner
          docker push "${IMAGE}:latest"
          docker push "${IMAGE}:main-${SHORT}"
          echo "pushed ${IMAGE}:latest and ${IMAGE}:main-${SHORT}"

      - name: Report immutable digest
        run: |
          set -eu
          export PATH="${HOME}/bin:${PATH}"
          IMAGE="${REGISTRY}/${IMAGE_NAME}"
          SHORT="${GITHUB_SHA:0:7}"
          docker inspect --format='{{index .RepoDigests 0}}' "${IMAGE}:main-${SHORT}"