name: Release image

on:
  push:
    branches: [main]
    tags: ['v*']
  workflow_dispatch:

jobs:
  build-and-push:
    name: Build and push single-container image
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      # driver: docker (not the action's default docker-container driver) so buildx reuses the
      # host's own dockerd instead of spinning up an isolated builder container — the isolated
      # one doesn't see the host's /etc/docker/certs.d, which is how the login step below trusts
      # the registry's self-signed cert (docs/DECISIONS.md D17). We don't need multi-platform
      # builds, so nothing the docker-container driver offers is actually lost here.
      - uses: docker/setup-buildx-action@v3
        with:
          driver: docker

      # secrets.GITEA_TOKEN cannot push to the Gitea container registry — a documented Gitea
      # limitation, not a misconfiguration (see CLAUDE.md). REGISTRY_TOKEN is a separate PAT with
      # package:write, expected to already exist as a repo secret.
      #
      # registry.bbergle.com:9537, not the raw 192.168.0.3:3000 Gitea talks HTTP on directly —
      # Docker refuses any non-localhost registry over plain HTTP by default. This hostname is an
      # NPMplus proxy host in front of Gitea's registry, terminating TLS with a self-signed cert;
      # the runner host trusts it via /etc/docker/certs.d/registry.bbergle.com:9537/ca.crt (not
      # committed here — host-local trust material, docs/DECISIONS.md D17 has the full setup).
      - uses: docker/login-action@v3
        with:
          registry: registry.bbergle.com:9537
          username: BBergle
          password: ${{ secrets.REGISTRY_TOKEN }}

      # `latest` should only ever mean "what's actually on main" (or a tagged release) — not
      # whatever a manual test dispatch off some feature branch happened to build. Learned the
      # hard way: a manual dispatch off this very branch, while verifying the fix above, silently
      # overwrote `latest` under the old unconditional-tags logic. Building the full tag list here
      # in bash (rather than a conditional expression inline in the tags: block below) means there's
      # never a blank line for build-push-action to choke on when latest isn't included.
      - name: Resolve image tags
        id: tag
        run: |
          IMG=registry.bbergle.com:9537/bbergle/bike-app
          if [ "${{ gitea.ref_type }}" = "tag" ]; then
            VALUE="${{ gitea.ref_name }}"
            UPDATE_LATEST=true
          elif [ "${{ gitea.ref_name }}" = "main" ] && [ "${{ gitea.event_name }}" = "push" ]; then
            VALUE="main-$(git rev-parse --short HEAD)"
            UPDATE_LATEST=true
          else
            VALUE="manual-$(date -u +%Y%m%d%H%M%S)-$(git rev-parse --short HEAD)"
            UPDATE_LATEST=false
          fi
          {
            echo "tags<<EOF"
            echo "$IMG:$VALUE"
            [ "$UPDATE_LATEST" = true ] && echo "$IMG:latest"
            echo "EOF"
          } >> "$GITHUB_OUTPUT"

      - uses: docker/build-push-action@v6
        with:
          context: .
          file: Dockerfile
          push: true
          tags: ${{ steps.tag.outputs.tags }}