# Gitea twin of .github/workflows/docker-publish.yml. Gitea runs only .gitea/workflows/ once this
# folder exists, and GitHub never reads it.
#
# Publishes to IPCR on watch.nsl.sh instead of ghcr.io:
#   push  ipcr-push-85-17-246-67.ip.nsl.sh/metadec.eth/<repo>:<tag>   docker login as metadec.eth with the
#         IPCR_PUSH_TOKEN secret (the metadec.eth namespace token from the IPCR dashboard)
#   pull  ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/<repo>:<tag>   anonymous
# The push goes to ipcr-push-85-17-246-67.ip.nsl.sh, the box's own address, not ipcr-push-watch.nsl.sh: Cloudflare fronts
# *.watch.nsl.sh and refuses any request over 100 MB (413), which a large image layer is.
# That host's certificate is signed by the box's private Mesh Router CA, given to buildkit from
# the IPCR_CA_PEM repo variable. docker login would make the job's Docker daemon check the
# certificate without that CA, so the login is written straight into ~/.docker/config.json.
# The runner's job image (node:22-bookworm) has no docker CLI, so the static one is
# installed first; buildx installs itself. No `type=gha` cache: the runner has none.

name: Build and Push Docker Image

on:
  push:
    branches:
      - main
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      tag:
        description: 'Tag for the image (optional, defaults to sha)'
        required: false
        type: string

env:
  REGISTRY: ipcr-push-85-17-246-67.ip.nsl.sh
  IMAGE_NAME: metadec.eth/${{ github.event.repository.name }}

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: write    # the release step below
      packages: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install Docker CLI
        run: curl -fsSL https://download.docker.com/linux/static/stable/x86_64/docker-28.5.1.tgz | tar -xz -C /usr/local/bin --strip-components=1 docker/docker

      - name: Trust the Mesh Router CA
        run: printf '%s\n' "$IPCR_CA_PEM" > /tmp/ipcr-ca.pem
        env:
          IPCR_CA_PEM: ${{ vars.IPCR_CA_PEM }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          version: latest
          buildkitd-config-inline: |
            [registry."${{ env.REGISTRY }}"]
              ca = ["/tmp/ipcr-ca.pem"]

      - name: Log in to IPCR
        env:
          IPCR_PUSH_TOKEN: ${{ secrets.IPCR_PUSH_TOKEN }}
        run: |
          mkdir -p ~/.docker
          printf '{"auths":{"%s":{"auth":"%s"}}}\n' "$REGISTRY" "$(printf 'metadec.eth:%s' "$IPCR_PUSH_TOKEN" | base64 -w0)" > ~/.docker/config.json

      - name: Extract metadata (tags, labels)
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=semver,pattern={{version}}
            # A fix to release 1.2.3 is tagged v1.2.3.1: four numbers are not semver, so
            # the pattern above makes no tag for it; this one does (image tag 1.2.3.1).
            type=match,pattern=v(\d+\.\d+\.\d+\.\d+),group=1
            type=semver,pattern={{major}}.{{minor}}
            type=sha,prefix=
            type=raw,value=latest,enable={{is_default_branch}}
            type=raw,value=${{ inputs.tag }},enable=${{ inputs.tag != '' }}

      - name: Build and push Docker image
        id: build
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

      # Gitea's Packages tab only lists images in Gitea's own registry, so a v* tag gets a
      # release instead, naming the image it shipped. The digest line is the one to trust:
      # ipcr 1.7.1 can drop some of the tags pushed together (see the tag list).
      - name: Publish the Gitea release
        if: startsWith(github.ref, 'refs/tags/v')
        env:
          TOKEN: ${{ secrets.GITEA_TOKEN }}
          API: ${{ github.server_url }}/api/v1/repos/${{ github.repository }}
          TAG: ${{ github.ref_name }}
          SHA: ${{ github.sha }}
          DIGEST: ${{ steps.build.outputs.digest }}
          TAGS: ${{ steps.meta.outputs.tags }}
          PULL: ipcr-watch.nsl.sh/ipns/metadec.eth/${{ env.IMAGE_NAME }}
        run: |
          node -e '
            const e = process.env, ver = e.TAG.replace(/^v/, "");
            const tags = e.TAGS.split("\n").filter(Boolean).map(t => "`" + t.split(":").pop() + "`");
            const body = [
              "**Image** (anonymous pull):",
              "```", `docker pull ${e.PULL}:${ver}`, "```",
              "Pinned by digest:",
              "```", `${e.PULL}@${e.DIGEST}`, "```",
              `Tags pushed: ${tags.join(", ")} · commit ${e.SHA.slice(0, 7)}`,
            ].join("\n");
            console.log(JSON.stringify({ tag_name: e.TAG, name: e.TAG, body }));
          ' > /tmp/release.json
          auth="Authorization: token $TOKEN"
          code=$(curl -s -o /tmp/existing.json -w '%{http_code}' -H "$auth" "$API/releases/tags/$TAG")
          if [ "$code" = 200 ]; then
            id=$(node -p 'require("/tmp/existing.json").id')
            method=PATCH url="$API/releases/$id"
          else
            method=POST url="$API/releases"
          fi
          code=$(curl -s -o /tmp/out.json -w '%{http_code}' -X "$method" -H "$auth" \
            -H 'Content-Type: application/json' --data @/tmp/release.json "$url")
          case "$code" in 2*) echo "release $TAG: $method $code" ;; *) cat /tmp/out.json; exit 1 ;; esac