name: Publish container image

on:
  push:
    tags:
      - '*'

permissions:
  contents: read
  packages: write

jobs:
  publish:
    name: Build and push image
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Derive image coordinates
        id: meta
        shell: bash
        run: |
          set -euo pipefail
          image="192.168.33.22:3300/gemma/arcana-fx"
          raw_tag="${GITHUB_REF_NAME:-${GITEA_REF_NAME:-unknown}}"
          safe_tag="$(printf '%s' "$raw_tag" | tr '[:upper:]' '[:lower:]' | sed 's#[^a-z0-9_.-]#-#g')"

          if [ -z "$safe_tag" ]; then
            echo "failed to derive image tag from ref name: $raw_tag" >&2
            exit 1
          fi

          echo "image=$image" >> "$GITHUB_OUTPUT"
          echo "tag=$safe_tag" >> "$GITHUB_OUTPUT"

      - name: Log in to Gitea container registry
        shell: bash
        env:
          PACKAGES_TOKEN: ${{ secrets.PACKAGES_TOKEN }}
        run: |
          set -euo pipefail
          printf '%s' "$PACKAGES_TOKEN" | docker login 192.168.33.22:3300 --username gemma --password-stdin

      - name: Build image
        shell: bash
        run: |
          set -euo pipefail
          docker build \
            --tag "${{ steps.meta.outputs.image }}:${{ steps.meta.outputs.tag }}" \
            --tag "${{ steps.meta.outputs.image }}:latest" \
            .

      - name: Push image tags
        shell: bash
        run: |
          set -euo pipefail
          docker push "${{ steps.meta.outputs.image }}:${{ steps.meta.outputs.tag }}"
          docker push "${{ steps.meta.outputs.image }}:latest"