name: Build and Publish dns-sync Image

on:
  push:
    branches: [ main ]
  workflow_dispatch:

jobs:
  build:
    runs-on: ubuntu-latest

    steps:
      # -------------------------------------------------
      # Checkout (manual, no Node, no external actions)
      # -------------------------------------------------
      - name: Checkout repository
        env:
          GITEA_TOKEN: ${{ secrets.TEA_TOKEN }}
        run: |
          set -euo pipefail

          rm -rf ./* ./.git || true

          BASE="${GITHUB_SERVER_URL%/}"
          REPO="${GITHUB_REPOSITORY}"

          if [ -n "${GITEA_TOKEN:-}" ]; then
            CLONE_URL="${BASE}/${REPO}.git"
            CLONE_URL="$(echo "$CLONE_URL" | sed -E 's#^https://#https://oauth2:'"${GITEA_TOKEN}"'@#')"
            git clone "$CLONE_URL" .
          else
            git clone "${BASE}/${REPO}.git" .
          fi

          git config --global --add safe.directory "$PWD"

      # -------------------------------------------------
      # Test source before building
      # -------------------------------------------------
      - name: Run test suite
        run: |
          set -euo pipefail

          python3 -m pip install --user requests PyYAML

          python3 -m unittest discover \
            -s tests \
            -v

      # -------------------------------------------------
      # Build image
      # -------------------------------------------------
      - name: Build image
        env:
          REGISTRY: ${{ vars.REGISTRY }}
        run: |
          set -euo pipefail

          SHORT_SHA="${GITHUB_SHA::7}"
          FULL_IMAGE="$REGISTRY/david/dns-sync"

          docker build \
            -f Containerfile \
            -t "$FULL_IMAGE:latest" \
            -t "$FULL_IMAGE:sha-$SHORT_SHA" \
            .

      # -------------------------------------------------
      # Verify locally before publishing
      # -------------------------------------------------
      - name: Verify image
        env:
          REGISTRY: ${{ vars.REGISTRY }}
        run: |
          set -euo pipefail

          FULL_IMAGE="$REGISTRY/david/dns-sync"

          docker image inspect "$FULL_IMAGE:latest" >/dev/null

          docker run --rm \
            --entrypoint python \
            "$FULL_IMAGE:latest" \
            -m dns_sync reconcile --help

          echo
          echo "Built image:"
          docker image ls "$FULL_IMAGE"

      # -------------------------------------------------
      # Login to container registry
      # -------------------------------------------------
      - name: Docker login
        env:
          REGISTRY: ${{ vars.REGISTRY }}
          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
          REGISTRY_TOKEN: ${{ secrets.TEA_TOKEN }}
        run: |
          set -euo pipefail

          echo "$REGISTRY_TOKEN" | docker login "$REGISTRY" \
            -u "$REGISTRY_USER" \
            --password-stdin

      # -------------------------------------------------
      # Publish
      # -------------------------------------------------
      - name: Publish image
        env:
          REGISTRY: ${{ vars.REGISTRY }}
        run: |
          set -euo pipefail

          SHORT_SHA="${GITHUB_SHA::7}"
          FULL_IMAGE="$REGISTRY/david/dns-sync"

          docker push "$FULL_IMAGE:latest"
          docker push "$FULL_IMAGE:sha-$SHORT_SHA"

      - name: Report published image
        env:
          REGISTRY: ${{ vars.REGISTRY }}
        run: |
          set -euo pipefail

          SHORT_SHA="${GITHUB_SHA::7}"
          FULL_IMAGE="$REGISTRY/david/dns-sync"

          echo "Published:"
          echo "  $FULL_IMAGE:latest"
          echo "  $FULL_IMAGE:sha-$SHORT_SHA"