name: Build and Push Docker Image

on:
  push:
    branches: [ main, master ]
    tags: [ 'v*', 'release-*' ]
  workflow_dispatch: {}

env:
  DOCKERFILE: Dockerfile

jobs:
  docker:
    runs-on: docker
    container:
      image: docker:27-cli
      env:
        DOCKER_HOST: tcp://docker:2375
        DOCKER_TLS_CERTDIR: ""
        DOCKER_BUILDKIT: "1"
    services:
      docker:
        image: docker:27-dind
        options: --privileged
        env:
          DOCKER_TLS_CERTDIR: ""
    steps:
      - name: Define Registry Variables
        id: vars
        run: |
          # Derive registry/namespace/image from Gitea context, normalize to lowercase
          OWNER="${{ gitea.repository_owner }}"
          REPO="${{ gitea.repository_name }}"
          OWNER=$(echo "$OWNER" | tr '[:upper:]' '[:lower:]')
          REPO=$(echo "$REPO" | tr '[:upper:]' '[:lower:]')

          # Allow overriding image name via repository variable IMAGE_NAME; default to repo name
          IMAGE_NAME="${{ vars.IMAGE_NAME }}"
          if [ -z "$IMAGE_NAME" ]; then IMAGE_NAME="$REPO"; fi
          IMAGE_NAME=$(echo "$IMAGE_NAME" | tr '[:upper:]' '[:lower:]')

          # Gitea exposes server URL like https://gitea.example.com
          # Prefer explicit var GITEA_REGISTRY; else, use the same host as Gitea server
          if [ -n "${{ vars.GITEA_REGISTRY }}" ]; then
            REGISTRY="${{ vars.GITEA_REGISTRY }}"
          else
            REGISTRY=$(echo "${{ gitea.server_url }}" | sed -E 's#^https?://##; s#/$##')
          fi

          echo "registry=$REGISTRY" >> "$GITHUB_OUTPUT"
          echo "owner=$OWNER" >> "$GITHUB_OUTPUT"
          echo "image=$IMAGE_NAME" >> "$GITHUB_OUTPUT"

      - name: Compute Tags
        id: tags
        env:
          REGISTRY: ${{ steps.vars.outputs.registry }}
          OWNER: ${{ steps.vars.outputs.owner }}
          IMAGE: ${{ steps.vars.outputs.image }}
        run: |
          set -euo pipefail
          IMAGE_FULL="$REGISTRY/$OWNER/$IMAGE"

          REF="$GITHUB_REF"
          SHA_SHORT=$(echo "$GITHUB_SHA" | cut -c1-8)
          TAGS=()

          case "$REF" in
            refs/heads/*)
              BRANCH=${REF#refs/heads/}
              # latest for main/master
              if [ "$BRANCH" = "main" ] || [ "$BRANCH" = "master" ]; then
                TAGS+=("latest")
              fi
              # branch tag
              SAFE_BRANCH=$(echo "$BRANCH" | tr '/' '-' )
              TAGS+=("$SAFE_BRANCH")
              ;;
            refs/tags/*)
              TAG=${REF#refs/tags/}
              TAGS+=("$TAG")
              ;;
          esac

          # always include short sha
          TAGS+=("$SHA_SHORT")

          # Build -t args
          TAG_ARGS=""
          for t in "${TAGS[@]}"; do
            TAG_ARGS="$TAG_ARGS -t $IMAGE_FULL:$t"
          done

          echo "image_full=$IMAGE_FULL" >> "$GITHUB_OUTPUT"
          echo "tag_args=$TAG_ARGS" >> "$GITHUB_OUTPUT"

      - name: Log in to Gitea Registry
        env:
          REGISTRY: ${{ steps.vars.outputs.registry }}
        run: |
          echo "${{ secrets.GITEA_TOKEN }}" | docker login "$REGISTRY" -u "$GITHUB_ACTOR" --password-stdin

      - name: Ensure buildx builder
        run: |
          docker buildx inspect >/dev/null 2>&1 || docker buildx create --use

      - name: Build and push (linux/amd64)
        env:
          DOCKERFILE: ${{ env.DOCKERFILE }}
          IMAGE_FULL: ${{ steps.tags.outputs.image_full }}
          TAG_ARGS: ${{ steps.tags.outputs.tag_args }}
        run: |
          set -euo pipefail
          echo "Building $IMAGE_FULL with tags: $TAG_ARGS"
          docker buildx build \
            --platform linux/amd64 \
            -f "$DOCKERFILE" \
            $TAG_ARGS \
            --cache-from type=registry,ref="$IMAGE_FULL:buildcache" \
            --cache-to type=registry,ref="$IMAGE_FULL:buildcache",mode=max \
            --push \
            .