# Uses the estate's tier-2 container-build runner and organization-scoped
# REGISTRY_USER / REGISTRY_TOKEN secrets.
name: Build and publish policy-nexus image

on:
  push:
    branches:
      - main
    paths:
      - ".forgejo/workflows/publish-image.yaml"
      - "Containerfile"
      - "deploy/**"
      - "publication.json"
      - "tests/**"
      - "tools/**"
  workflow_dispatch:

env:
  REGISTRY: forgejo.coulomb.social
  IMAGE_NAME: coulomb/policy-nexus
  DOCKER_HOST: tcp://127.0.0.1:2375

jobs:
  build-and-push:
    runs-on: container-build
    steps:
      - name: Build, verify, and publish immutable policy artifact
        env:
          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
        run: |
          set -eu
          REF="${GITHUB_SHA:-main}"
          SHORT="${REF:0:7}"
          mkdir -p buildctx/_sources/net-kingdom "${HOME}/bin"

          wget -qO /tmp/policy-nexus.tar.gz \
            "https://forgejo.coulomb.social/${GITHUB_REPOSITORY}/archive/${SHORT}.tar.gz"
          tar xzf /tmp/policy-nexus.tar.gz -C buildctx --strip-components=1

          NETKINGDOM_REVISION=$(git ls-remote \
            https://forgejo.coulomb.social/coulomb/net-kingdom.git \
            refs/heads/main | awk '{print $1}')
          test -n "$NETKINGDOM_REVISION"
          NETKINGDOM_SHORT="$(printf '%s' "$NETKINGDOM_REVISION" | cut -c1-7)"
          wget -qO /tmp/net-kingdom.tar.gz \
            "https://forgejo.coulomb.social/coulomb/net-kingdom/archive/${NETKINGDOM_SHORT}.tar.gz"
          tar xzf /tmp/net-kingdom.tar.gz \
            -C buildctx/_sources/net-kingdom --strip-components=1

          wget -qO- https://download.docker.com/linux/static/stable/x86_64/docker-27.3.1.tgz \
            | tar xz --strip-components=1 -C "${HOME}/bin" docker/docker
          export PATH="${HOME}/bin:${PATH}"
          docker version
          echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" \
            -u "${REGISTRY_USER}" --password-stdin

          IMAGE="${REGISTRY}/${IMAGE_NAME}"
          docker build \
            --file buildctx/Containerfile \
            --build-arg "VCS_REVISION=${REF}" \
            --build-arg "NETKINGDOM_REVISION=${NETKINGDOM_REVISION}" \
            --tag "${IMAGE}:git-${REF}" \
            --tag "${IMAGE}:main" \
            buildctx
          docker push "${IMAGE}:git-${REF}"
          docker push "${IMAGE}:main"

          PUBLICATION_DIGEST=$(docker run --rm --entrypoint sha256sum \
            "${IMAGE}:git-${REF}" /usr/share/nginx/html/publication-manifest.json \
            | awk '{print $1}')
          echo "published=${IMAGE}:git-${REF}"
          echo "publication_manifest_digest=${PUBLICATION_DIGEST}"