# Forgejo Actions build — push image on main only.
# Tag is commit short SHA: unique, immutable, maps to exactly one commit.
# No write-back, no git push — ArgoCD Image Updater pulls new builds autonomously.
# Enabled by Stage 1 (B, C1).
name: Build

on:
  push:
    branches: [main]

env:
  REGISTRY: forgejo.riotpiao.com
  IMAGE: forgejo.riotpiao.com/rock/api-gateway

jobs:
  build:
    name: Build and push image
    # golang, not a retired generic "docker" runner -- this repo is Go, and
    # every runner now carries its own dind sidecar to build/push that
    # repo's images. `container.image` below overrides the runner's own
    # default (golang:1.25-bookworm) with docker:27-cli for this job only.
    runs-on: golang
    container:
      image: docker:27-cli
      # No `options: --network host` here -- act_runner ignores that per-job
      # override and always decides the job container's network from its own
      # config.yaml (container.network), which defaults to an isolated
      # per-job bridge. Confirmed live: with that default, DOCKER_HOST=
      # tcp://localhost:2376 resolved to the job container itself, not dind,
      # so every command past `docker login` (which never touches DOCKER_HOST
      # -- it only talks to the registry) failed with "Cannot connect to the
      # Docker daemon". host networking is set once, for every job, in the
      # runner's own Helm chart.
      #
      # The mTLS certs dind generates at startup are a separate gap: they
      # live in an emptyDir mounted into the runner/dind containers, not into
      # containers a workflow spins up. Job containers get no bind mounts at
      # all unless the path is in the runner's container.valid_volumes
      # allowlist (empty by default -- this exact mount was rejected until
      # the runner's Helm chart added a config.yaml scoping valid_volumes to
      # exactly this path).
      volumes:
        - /docker-certs/client:/docker-certs/client:ro
    env:
      DOCKER_HOST: tcp://localhost:2376
      DOCKER_TLS_VERIFY: "1"
      DOCKER_CERT_PATH: /docker-certs/client
    steps:
      # actions/checkout@v4 is a JS action -- Forgejo Actions execs it with
      # `node`, which docker:27-cli (Alpine) doesn't ship. Without this the
      # checkout step fails with "exec: node: executable file not found in
      # $PATH" before any of the job's own steps run. Verified locally:
      # `apk add --no-cache nodejs git` in this exact image gets node v22 +
      # git 2.47, and the checkout action's dist/index.js then actually
      # executes (confirmed by running it directly) instead of failing on a
      # missing binary.
      - name: install node (required by JS-based actions)
        run: apk add --no-cache nodejs git

      - uses: actions/checkout@v4

      - name: Get short SHA
        id: sha
        run: |
          SHORT_SHA=$(git rev-parse --short HEAD)
          echo "short_sha=${SHORT_SHA}" >> $GITHUB_OUTPUT

      - name: Registry login
        run: |
          echo "${GITHUB_TOKEN}" | docker login "${REGISTRY}" \
            --username rock --password-stdin
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Build
        run: |
          docker build \
            --build-arg "VERSION=${{ steps.sha.outputs.short_sha }}" \
            -t "${IMAGE}:${{ steps.sha.outputs.short_sha }}" \
            .

      - name: Push
        run: docker push "${IMAGE}:${{ steps.sha.outputs.short_sha }}"

      - name: Report digest
        run: |
          docker inspect --format='{{index .RepoDigests 0}}' "${IMAGE}:${{ steps.sha.outputs.short_sha }}"