name: Build control-plane image

# Publishes control_plane as a versioned image to this Forgejo instance's
# own container registry, so `docker stack deploy` (which never reads
# `build:`, see README's Swarm caveats) doesn't need an operator to build
# and tag it by hand first.
#
# Self-hosted runner, plain `docker build`/`docker push` rather than the
# docker/build-push-action marketplace action: unconfirmed whether that
# action is mirrored on this instance's action runner (furtka's own
# ci.yml hit exactly this gap with lycheeverse/lychee-action and had to
# fall back to a fully-qualified github.com URL), and raw docker commands
# sidestep the question entirely — same reasoning as release.yml/
# build-iso.yml using plain shell for their heavy lifting.
on:
  push:
    branches: [master]
    tags: ['**']
    paths:
      - 'control_plane/**'
      - '.forgejo/workflows/build-image.yml'
  workflow_dispatch:

concurrency:
  group: build-image-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build-image:
    runs-on: self-hosted
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v4

      - name: Log in to this instance's container registry
        # GITHUB_TOKEN here is Forgejo's own auto-issued Actions token,
        # scoped to this repo with package read/write — not a GitHub
        # token. Standard Forgejo/Gitea Actions pattern.
        run: |
          echo "${{ secrets.GITHUB_TOKEN }}" | docker login "${{ vars.FORGEJO_HOST || 'forgejo.sourcegate.online' }}" \
            -u "${{ github.actor }}" --password-stdin

      - name: Build image
        run: |
          docker build -t control-plane:build ./control_plane

      - name: Tag and push
        env:
          REGISTRY: ${{ vars.FORGEJO_HOST || 'forgejo.sourcegate.online' }}
          IMAGE: furtka-gateway-control-plane
        run: |
          set -e
          sha_tag="${GITHUB_SHA::12}"
          docker tag control-plane:build "$REGISTRY/${{ github.repository_owner }}/$IMAGE:$sha_tag"
          docker push "$REGISTRY/${{ github.repository_owner }}/$IMAGE:$sha_tag"

          # `latest` tracks master; a version-tag push (e.g. from a future
          # CalVer release process, see furtka/RELEASING.md for the
          # pattern this would mirror) additionally publishes under that
          # tag's own name.
          if [ "${{ github.ref_type }}" = "branch" ]; then
            docker tag control-plane:build "$REGISTRY/${{ github.repository_owner }}/$IMAGE:latest"
            docker push "$REGISTRY/${{ github.repository_owner }}/$IMAGE:latest"
          else
            docker tag control-plane:build "$REGISTRY/${{ github.repository_owner }}/$IMAGE:${{ github.ref_name }}"
            docker push "$REGISTRY/${{ github.repository_owner }}/$IMAGE:${{ github.ref_name }}"
          fi