name: Build and publish website container

on:
  push:
    branches: [main, container-ci]
  workflow_dispatch:

jobs:
  build:
    runs-on: linux-amd64-docker-small
    timeout-minutes: 35
    container:
      image: docker:29.1.3-cli
    env:
      IMAGE_REPOSITORY: gitea.kenanzhu.com/autolibrary/website
      RELEASE_SHA: ${{ gitea.sha }}
    steps:
      - name: Install checkout tools
        shell: sh
        run: apk add --no-cache bash git

      - name: Check out the pushed commit
        uses: builtin:checkout
        with:
          ref: ${{ gitea.sha }}
          persist-credentials: false

      - name: Build and test the image
        shell: bash
        run: |
          set -euo pipefail
          docker info --format '{{range .SecurityOptions}}{{println .}}{{end}}' | grep -Fx 'name=rootless'
          image="${IMAGE_REPOSITORY}:${RELEASE_SHA}"
          docker build -t "$image" .
          bash deploy/smoke-container.sh "$image"

      - name: Push the tested image to Gitea
        if: ${{ gitea.ref == 'refs/heads/main' || gitea.ref == 'refs/heads/container-ci' }}
        shell: bash
        env:
          REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
        run: |
          set -euo pipefail
          : "${REGISTRY_USERNAME:?Add the REGISTRY_USERNAME repository secret}"
          : "${REGISTRY_TOKEN:?Add the REGISTRY_TOKEN repository secret}"
          DOCKER_CONFIG=$(mktemp -d)
          export DOCKER_CONFIG
          trap 'rm -rf -- "$DOCKER_CONFIG"' EXIT
          printf '%s\n' "$REGISTRY_TOKEN" | docker login "${IMAGE_REPOSITORY%%/*}" \
            --username "$REGISTRY_USERNAME" --password-stdin
          docker push "${IMAGE_REPOSITORY}:${RELEASE_SHA}" | tee "$DOCKER_CONFIG/push.log"
          digest=$(awk '$2 == "digest:" {print $3}' "$DOCKER_CONFIG/push.log")
          [[ $digest =~ ^sha256:[0-9a-f]{64}$ ]]
          echo "Published ${IMAGE_REPOSITORY}@${digest}"

      - name: Remove the local image tag
        if: always()
        shell: bash
        run: docker image rm "${IMAGE_REPOSITORY}:${RELEASE_SHA}" >/dev/null 2>&1 || true