name: Release image

on:
  push:
    tags: ['v*']
  workflow_dispatch:

jobs:
  build-and-push:
    name: Build and push single-container image
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      # driver: docker (not the action's default docker-container driver) so buildx reuses the
      # host's own dockerd instead of spinning up an isolated builder container — the isolated
      # one doesn't see the host's /etc/docker/certs.d, which is how the login step below trusts
      # the registry's self-signed cert (docs/DECISIONS.md D17). We don't need multi-platform
      # builds, so nothing the docker-container driver offers is actually lost here.
      - uses: docker/setup-buildx-action@v3
        with:
          driver: docker

      # secrets.GITEA_TOKEN cannot push to the Gitea container registry — a documented Gitea
      # limitation, not a misconfiguration (see CLAUDE.md). REGISTRY_TOKEN is a separate PAT with
      # package:write, expected to already exist as a repo secret.
      #
      # registry.bbergle.com:9537, not the raw 192.168.0.3:3000 Gitea talks HTTP on directly —
      # Docker refuses any non-localhost registry over plain HTTP by default. This hostname is an
      # NPMplus proxy host in front of Gitea's registry, terminating TLS with a self-signed cert;
      # the runner host trusts it via /etc/docker/certs.d/registry.bbergle.com:9537/ca.crt (not
      # committed here — host-local trust material, docs/DECISIONS.md D17 has the full setup).
      - uses: docker/login-action@v3
        with:
          registry: registry.bbergle.com:9537
          username: BBergle
          password: ${{ secrets.REGISTRY_TOKEN }}

      - name: Resolve image tag
        id: tag
        run: |
          if [ "${{ gitea.ref_type }}" = "tag" ]; then
            echo "value=${{ gitea.ref_name }}" >> "$GITHUB_OUTPUT"
          else
            echo "value=manual-$(date -u +%Y%m%d%H%M%S)" >> "$GITHUB_OUTPUT"
          fi

      - uses: docker/build-push-action@v6
        with:
          context: .
          file: Dockerfile
          push: true
          tags: |
            registry.bbergle.com:9537/bbergle/bike-app:latest
            registry.bbergle.com:9537/bbergle/bike-app:${{ steps.tag.outputs.value }}