name: Build and Publish RMManager Image

on:
  push:
    branches: [main]
  workflow_dispatch:

jobs:
  build:
    runs-on: ubuntu-latest

    steps:
      # ---------------------------------------------
      # Checkout repository (no external actions)
      # ---------------------------------------------
      - name: Checkout repository
        env:
          GITEA_TOKEN: ${{ secrets.TEA_TOKEN }}
        run: |
          set -euo pipefail

          BASE="${GITHUB_SERVER_URL%/}"
          REPO="${GITHUB_REPOSITORY}"

          git init .
          git remote add origin "$BASE/$REPO.git"

          if [ -n "${GITEA_TOKEN:-}" ]; then
            AUTH="$(printf 'oauth2:%s' "$GITEA_TOKEN" | base64 -w0)"
            git -c "http.extraHeader=Authorization: Basic $AUTH" \
              fetch --depth 1 origin "$GITHUB_SHA"
          else
            git fetch --depth 1 origin "$GITHUB_SHA"
          fi

          git checkout --detach FETCH_HEAD
          git config --global --add safe.directory "$PWD"

      # ---------------------------------------------
      # Determine image version and commit SHA
      # ---------------------------------------------
      - name: Determine version
        id: version
        run: |
          set -euo pipefail

          SHORT_SHA="$(git rev-parse --short=7 HEAD)"
          echo "sha=$SHORT_SHA" >> "$GITHUB_OUTPUT"

          if [ -f VERSION ]; then
            VERSION="$(tr -d '[:space:]' < VERSION)"
            echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          else
            echo "version=" >> "$GITHUB_OUTPUT"
          fi

      # ---------------------------------------------
      # Login to Gitea container registry
      # ---------------------------------------------
      - name: Docker login
        env:
          REGISTRY: ${{ vars.REGISTRY }}
          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
          REGISTRY_TOKEN: ${{ secrets.TEA_TOKEN }}
        run: |
          set -euo pipefail

          echo "$REGISTRY_TOKEN" | docker login "$REGISTRY" \
            -u "$REGISTRY_USER" \
            --password-stdin

      # ---------------------------------------------
      # Build and export container image
      # ---------------------------------------------
      - name: Build RMManager image
        env:
          REGISTRY: ${{ vars.REGISTRY }}
          VERSION: ${{ steps.version.outputs.version }}
          SHORT_SHA: ${{ steps.version.outputs.sha }}
        run: |
          set -euo pipefail

          FULL_IMAGE="$REGISTRY/david/rmmanager"

          docker build \
            -f Containerfile \
            -t "$FULL_IMAGE:latest" \
            -t "$FULL_IMAGE:sha-$SHORT_SHA" \
            --output "type=docker,dest=$RUNNER_TEMP/rmmanager-built.tar" \
            .

      # ---------------------------------------------
      # Load exported image into Docker
      # ---------------------------------------------
      - name: Load RMManager image
        run: |
          set -euo pipefail

          docker load \
            --input "$RUNNER_TEMP/rmmanager-built.tar"

      # ---------------------------------------------
      # Add optional version tag
      # ---------------------------------------------
      - name: Tag RMManager image
        env:
          REGISTRY: ${{ vars.REGISTRY }}
          VERSION: ${{ steps.version.outputs.version }}
        run: |
          set -euo pipefail

          FULL_IMAGE="$REGISTRY/david/rmmanager"

          if [ -n "$VERSION" ]; then
            docker tag \
              "$FULL_IMAGE:latest" \
              "$FULL_IMAGE:v$VERSION"
          fi

      # ---------------------------------------------
      # Verify local image and tags
      # ---------------------------------------------
      - name: Verify RMManager image
        env:
          REGISTRY: ${{ vars.REGISTRY }}
          VERSION: ${{ steps.version.outputs.version }}
          SHORT_SHA: ${{ steps.version.outputs.sha }}
        run: |
          set -euo pipefail

          FULL_IMAGE="$REGISTRY/david/rmmanager"

          docker version
          docker image ls

          docker image inspect "$FULL_IMAGE:latest"
          docker image inspect "$FULL_IMAGE:sha-$SHORT_SHA"

          if [ -n "$VERSION" ]; then
            docker image inspect "$FULL_IMAGE:v$VERSION"
          fi

      # ---------------------------------------------
      # Publish image to Gitea registry
      # ---------------------------------------------
      - name: Push RMManager image
        env:
          REGISTRY: ${{ vars.REGISTRY }}
          VERSION: ${{ steps.version.outputs.version }}
          SHORT_SHA: ${{ steps.version.outputs.sha }}
        run: |
          set -euo pipefail

          FULL_IMAGE="$REGISTRY/david/rmmanager"

          docker push "$FULL_IMAGE:latest"
          docker push "$FULL_IMAGE:sha-$SHORT_SHA"

          if [ -n "$VERSION" ]; then
            docker push "$FULL_IMAGE:v$VERSION"
          fi

      # ---------------------------------------------
      # Report successful build
      # ---------------------------------------------
      - name: Report build
        env:
          REGISTRY: ${{ vars.REGISTRY }}
          VERSION: ${{ steps.version.outputs.version }}
          SHORT_SHA: ${{ steps.version.outputs.sha }}
        run: |
          set -euo pipefail

          echo "RMManager build and publish completed"
          echo "Image: $REGISTRY/david/rmmanager"
          echo "Latest tag: latest"
          echo "Commit tag: sha-$SHORT_SHA"

          if [ -n "$VERSION" ]; then
            echo "Version tag: v$VERSION"
          fi