# Forgejo Actions build — push image on main only.
# Tag is commit short SHA: unique, immutable, maps to exactly one commit.
# No write-back, no git push — ArgoCD Image Updater pulls new builds autonomously.
# Enabled by Stage 1 (B, C1).
name: Build

on:
  push:
    branches: [main]

env:
  REGISTRY: forgejo.riotpiao.com
  IMAGE: forgejo.riotpiao.com/rock/api-gateway

jobs:
  build:
    name: Build and push image
    runs-on: docker
    container:
      image: docker:27-cli
      # The runner's dind sidecar shares the pod network, so the daemon is
      # reachable on localhost -- that part needs no extra config. The mTLS
      # certs dind generates at startup do NOT come along for free, though:
      # they live in an emptyDir mounted into the runner/dind containers, not
      # into containers a workflow spins up. Job containers get no bind mounts
      # at all unless the path is in the runner's container.valid_volumes
      # allowlist (empty by default -- confirmed live, this exact mount was
      # rejected until the runner's Helm chart added a config.yaml scoping
      # valid_volumes to exactly this path).
      options: --network host
      volumes:
        - /docker-certs/client:/docker-certs/client:ro
    env:
      DOCKER_HOST: tcp://localhost:2376
      DOCKER_TLS_VERIFY: "1"
      DOCKER_CERT_PATH: /docker-certs/client
    steps:
      # actions/checkout@v4 is a JS action -- Forgejo Actions execs it with
      # `node`, which docker:27-cli (Alpine) doesn't ship. Without this the
      # checkout step fails with "exec: node: executable file not found in
      # $PATH" before any of the job's own steps run. Verified locally:
      # `apk add --no-cache nodejs git` in this exact image gets node v22 +
      # git 2.47, and the checkout action's dist/index.js then actually
      # executes (confirmed by running it directly) instead of failing on a
      # missing binary.
      - name: install node (required by JS-based actions)
        run: apk add --no-cache nodejs git

      - uses: actions/checkout@v4

      - name: Get short SHA
        id: sha
        run: |
          SHORT_SHA=$(git rev-parse --short HEAD)
          echo "short_sha=${SHORT_SHA}" >> $GITHUB_OUTPUT

      - name: Registry login
        run: |
          echo "${FORGEJO_PAT}" | docker login "${REGISTRY}" \
            --username rock --password-stdin
        env:
          FORGEJO_PAT: ${{ secrets.FORGEJO_RIOTPIAO_PAT }}

      - name: Build
        run: |
          docker build \
            --build-arg "VERSION=${{ steps.sha.outputs.short_sha }}" \
            -t "${IMAGE}:${{ steps.sha.outputs.short_sha }}" \
            .

      - name: Push
        run: docker push "${IMAGE}:${{ steps.sha.outputs.short_sha }}"

      - name: Report digest
        run: |
          docker inspect --format='{{index .RepoDigests 0}}' "${IMAGE}:${{ steps.sha.outputs.short_sha }}"