# Container image publish to forgejo.coulomb.social (RAILIANCE-WP-0014).
# Org secrets: REGISTRY_USER, REGISTRY_TOKEN
name: Build and Publish Container Image

on:
  push:
    branches:
      - main
    paths:
      - ".forgejo/workflows/image.yaml"
      - "Dockerfile"
      - "pyproject.toml"
      - "uv.lock"
      - "package.json"
      - "package-lock.json"
      - "vergabe_teilnahme/**"
      - "static/**"
      - "templates/**"
      - "conftest.py"
      - "scripts/ci-docker.sh"
  workflow_dispatch:

env:
  REGISTRY: forgejo.coulomb.social
  IMAGE_NAME: coulomb/vergabe-teilnahme
  DOCKER_HOST: tcp://127.0.0.1:2375

jobs:
  build-and-push:
    runs-on: container-build
    steps:
      - name: Build and push image
        env:
          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
        run: |
          set -eu
          REF="${GITHUB_SHA:-main}"
          mkdir -p buildctx
          wget -qO /tmp/repo.tar.gz \
            "https://forgejo.coulomb.social/${GITHUB_REPOSITORY}/archive/${REF}.tar.gz"
          tar xzf /tmp/repo.tar.gz -C buildctx --strip-components=1
          . buildctx/scripts/ci-docker.sh
          docker version
          # Test the exact source before registry login or image publication.
          docker build --target application-tests buildctx
          echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" -u "${REGISTRY_USER}" --password-stdin
          SHORT="${REF:0:7}"
          IMAGE="${REGISTRY}/${IMAGE_NAME}"
          docker build -t "${IMAGE}:latest" -t "${IMAGE}:${SHORT}" -t "${IMAGE}:main-${SHORT}" buildctx
          docker push "${IMAGE}:latest"
          docker push "${IMAGE}:${SHORT}"
          docker push "${IMAGE}:main-${SHORT}"
          echo "pushed ${IMAGE}:latest ${IMAGE}:${SHORT}"