name: Publish container image

on:
  push:
    tags:
      - '*'

permissions:
  contents: read
  packages: write

jobs:
  publish:
    name: Build and push image
    runs-on: linux_amd64
    steps:
      - name: Fetch tagged source
        id: checkout
        shell: bash
        run: |
          set -euo pipefail
          repo_url="${GITHUB_SERVER_URL:-http://192.168.33.22:3300}/gemma/arcana-fx.git"
          tag="${GITHUB_REF_NAME:-${GITEA_REF_NAME:-}}"
          workdir="$(mktemp -d)"

          if [ -z "$tag" ]; then
            echo "missing tag name in workflow environment" >&2
            exit 1
          fi

          git clone --depth 1 --branch "$tag" "$repo_url" "$workdir/repo"
          echo "dir=$workdir/repo" >> "$GITHUB_OUTPUT"

      - name: Derive image coordinates
        id: meta
        shell: bash
        run: |
          set -euo pipefail
          image="192.168.33.22:3300/gemma/arcana-fx"
          raw_tag="${GITHUB_REF_NAME:-${GITEA_REF_NAME:-unknown}}"
          safe_tag="$(printf '%s' "$raw_tag" | tr '[:upper:]' '[:lower:]' | sed 's#[^a-z0-9_.-]#-#g')"

          if [ -z "$safe_tag" ]; then
            echo "failed to derive image tag from ref name: $raw_tag" >&2
            exit 1
          fi

          echo "image=$image" >> "$GITHUB_OUTPUT"
          echo "tag=$safe_tag" >> "$GITHUB_OUTPUT"

      - name: Log in to Gitea container registry
        shell: bash
        env:
          PACKAGES_TOKEN: ${{ secrets.PACKAGES_TOKEN }}
        run: |
          set -euo pipefail
          printf '%s' "$PACKAGES_TOKEN" | docker login 192.168.33.22:3300 --username gemma --password-stdin

      - name: Build image
        shell: bash
        run: |
          set -euo pipefail
          docker build \
            --tag "${{ steps.meta.outputs.image }}:${{ steps.meta.outputs.tag }}" \
            --tag "${{ steps.meta.outputs.image }}:latest" \
            "${{ steps.checkout.outputs.dir }}"

      - name: Push image tags
        shell: bash
        run: |
          set -euo pipefail
          docker push "${{ steps.meta.outputs.image }}:${{ steps.meta.outputs.tag }}"
          docker push "${{ steps.meta.outputs.image }}:latest"