# Forgejo Actions CI. Note the path: Forgejo reads .forgejo/workflows/, not
# .github/workflows/. The remote for this repo is git.riotpiao.com, so a GitHub
# workflow here would never run.
#
# runs-on: docker matches the only label the cluster runner declares
# (talos-runner, labels: [docker]).
name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

env:
  REGISTRY: forgejo.riotpiao.com
  IMAGE: forgejo.riotpiao.com/rock/api-gateway

jobs:
  verify:
    name: Test, vet, build
    runs-on: docker
    container:
      image: golang:1.25-bookworm
    steps:
      - uses: actions/checkout@v4

      - name: go vet
        run: go vet ./...

      # The race detector needs cgo, so this cannot run with CGO_ENABLED=0.
      - name: go test -race
        run: go test ./... -race

      - name: Static build
        run: CGO_ENABLED=0 go build -trimpath -o gateway ./cmd/gateway

      - name: govulncheck
        run: |
          go install golang.org/x/vuln/cmd/govulncheck@latest
          govulncheck ./...
        continue-on-error: true

  image:
    name: Build and push image
    runs-on: docker
    needs: verify
    # Only publish from main. PRs get the verify job and nothing else, so an
    # untrusted branch can never push a tag the cluster might pull.
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    container:
      image: docker:27-cli
      # The runner's dind sidecar shares the pod network and the mTLS cert
      # emptyDir, so the daemon is reachable on localhost with the client certs
      # dind generated at startup.
      options: --network host
    env:
      DOCKER_HOST: tcp://localhost:2376
      DOCKER_TLS_VERIFY: "1"
      DOCKER_CERT_PATH: /docker-certs/client
    steps:
      - uses: actions/checkout@v4

      - name: Registry login
        run: |
          echo "${FORGEJO_PAT}" | docker login "${REGISTRY}" \
            --username rock --password-stdin
        env:
          FORGEJO_PAT: ${{ secrets.FORGEJO_RIOTPIAO_PAT }}

      # SHA tags only. 6.1 requires them, and :latest makes an Argo rollout
      # non-deterministic — the same tag can resolve to different bits.
      - name: Build
        run: |
          docker build \
            --build-arg "VERSION=${GITHUB_SHA}" \
            -t "${IMAGE}:${GITHUB_SHA}" \
            .

      - name: Push
        run: docker push "${IMAGE}:${GITHUB_SHA}"

      - name: Report digest
        run: |
          docker inspect --format='{{index .RepoDigests 0}}' "${IMAGE}:${GITHUB_SHA}"