name: Immutable QuickStack OCI deployment

on:
  push:
    branches:
      - "**"
  pull_request:
  workflow_dispatch:

concurrency:
  group: quickstack-oci-${{ gitea.repository }}-${{ gitea.ref }}
  cancel-in-progress: false

jobs:
  build_and_deploy:
    name: Build once and deploy exact digest
    runs-on: ubuntu-latest
    permissions:
      contents: write
      releases: write
    steps:
      - name: Checkout consuming repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 2

      - name: Build and deploy declared QuickStack targets
        uses: https://gitea.nuvisphere.de/Nuvisphere/Platform-CI/.gitea/actions/quickstack-oci@main
        with:
          config-path: .quickstack/deploy.json
        env:
          REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
          QUICKSTACK_API_TOKEN: ${{ secrets.QUICKSTACK_API_TOKEN }}
          QUICKSTACK_BASE_URL: https://server.nuvisphere.de
          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
          MINIO_ENDPOINT: ${{ secrets.MINIO_ENDPOINT }}
          NEXT_PUBLIC_MINIO_ENDPOINT: ${{ secrets.NEXT_PUBLIC_MINIO_ENDPOINT }}
          MINIO_REGION: ${{ secrets.MINIO_REGION }}
          MINIO_ROOT_USER: ${{ secrets.MINIO_ROOT_USER }}
          MINIO_ROOT_PASSWORD: ${{ secrets.MINIO_ROOT_PASSWORD }}
          MINIO_TLS_REJECT_UNAUTHORIZED: ${{ secrets.MINIO_TLS_REJECT_UNAUTHORIZED }}
          MINIO_AVATAR_BUCKET: ${{ secrets.MINIO_AVATAR_BUCKET }}
          REDIS_URL: ${{ secrets.REDIS_URL }}
          WEB_PUSH_PUBLIC_KEY: ${{ secrets.WEB_PUSH_PUBLIC_KEY }}
          WEB_PUSH_PRIVATE_KEY: ${{ secrets.WEB_PUSH_PRIVATE_KEY }}
          WEB_PUSH_SUBJECT: ${{ secrets.WEB_PUSH_SUBJECT }}
          SMTP_HOST: ${{ secrets.SMTP_HOST }}
          SMTP_PORT: ${{ secrets.SMTP_PORT }}
          SMTP_SECURE: ${{ secrets.SMTP_SECURE }}
          SMTP_USER: ${{ secrets.SMTP_USER }}
          SMTP_PASS: ${{ secrets.SMTP_PASS }}