name: QuickStack runner job image

on:
  push:
    branches:
      - main
    paths:
      - runner-images/quickstack-job/**
      - .gitea/workflows/runner-image.yml
  pull_request:
    branches:
      - main
    paths:
      - runner-images/quickstack-job/**
      - .gitea/workflows/runner-image.yml
  workflow_dispatch:

env:
  REGISTRY: gitea.nuvisphere.de
  IMAGE: gitea.nuvisphere.de/nuvisphere/quickstack-job
  STABLE_TAG: node20-docker27
  DOCKERFILE: runner-images/quickstack-job/Dockerfile
  CONTEXT: runner-images/quickstack-job

jobs:
  build:
    name: Build and publish runner image
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Build image
        run: |
          set -euo pipefail
          docker buildx create --name quickstack-runner-image --use || docker buildx use quickstack-runner-image
          docker buildx build \
            --load \
            --progress=plain \
            --file "$DOCKERFILE" \
            --tag "$IMAGE:$STABLE_TAG" \
            "$CONTEXT"

      - name: Verify image tools
        run: |
          set -euo pipefail
          docker run --rm "$IMAGE:$STABLE_TAG" bash -lc '
            node --version
            git --version
            docker --version
            docker buildx version
            jq --version
            curl --version
            zstd --version
          '

      - name: Login to Gitea registry
        if: ${{ gitea.event_name != 'pull_request' }}
        env:
          REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
        run: |
          set -euo pipefail
          test -n "$REGISTRY_USERNAME"
          test -n "$REGISTRY_TOKEN"
          echo "$REGISTRY_TOKEN" | docker login "$REGISTRY" --username "$REGISTRY_USERNAME" --password-stdin

      - name: Publish image
        if: ${{ gitea.event_name != 'pull_request' }}
        env:
          COMMIT_SHA: ${{ gitea.sha }}
        run: |
          set -euo pipefail
          docker tag "$IMAGE:$STABLE_TAG" "$IMAGE:sha-$COMMIT_SHA"
          docker push "$IMAGE:$STABLE_TAG"
          docker push "$IMAGE:sha-$COMMIT_SHA"