# CI: `npm run check` on every push; on master/foundations and on release tags (v…) also build the image and push it to
# the Gitea registry. It does not deploy: that is the deploy workflow, started by hand (docs/DEPLOY.md).
name: ci

on:
  push:
  workflow_dispatch:

env:
  # Job containers cannot reach Gitea through traefik (its ipwhitelist does not cover the runner networks),
  # so checkout goes straight to the port Gitea publishes on VM103.
  GITEA_INTERNAL_URL: http://192.168.0.139:13080
  REGISTRY: git.mariuszpacek.pl

jobs:
  check:
    runs-on: ubuntu-latest
    container:
      image: node:24-bookworm@sha256:6dac556d980b7f0e5498d08f08cee0ca67798b4ad6c23964a9214920e67758d0
    steps:
      - uses: actions/checkout@v4
        with:
          github-server-url: ${{ env.GITEA_INTERNAL_URL }}
      # The function-runtime sandbox tests need bubblewrap; the runtime refuses to run functions without it.
      - run: apt-get update -qq && apt-get install -y -qq --no-install-recommends bubblewrap >/dev/null && bwrap --version
      - run: npm ci
      - run: npm run check

  publish:
    needs: check
    if: github.ref_name == 'master' || github.ref_name == 'foundations' || startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          github-server-url: ${{ env.GITEA_INTERNAL_URL }}
      - name: Docker CLI available (talks to the VM daemon through the mounted socket)
        run: command -v docker >/dev/null || (apt-get update -qq && apt-get install -y -qq docker.io >/dev/null); docker version --format '{{.Client.Version}} -> {{.Server.Version}}'
      - name: Build and push
        env:
          REGISTRY_USER: ${{ github.repository_owner }}
          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
          BUILD_NUMBER: ${{ github.run_number }}
        run: |
          set -euo pipefail
          image="${REGISTRY}/${GITHUB_REPOSITORY_OWNER}/homelab-upgrade"
          branch="${GITHUB_REF_NAME//\//-}"
          refs=("${image}:${GITHUB_SHA}" "${image}:${branch}")
          [ "${GITHUB_REF_NAME}" = master ] && refs+=("${image}:latest")
          printf '%s' "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" -u "${REGISTRY_USER}" --password-stdin
          tag_args=(); for ref in "${refs[@]}"; do tag_args+=(-t "${ref}"); done
          docker build --build-arg "REVISION=${GITHUB_SHA}" --build-arg "BRANCH=${GITHUB_REF_NAME}" --build-arg "BUILD_NUMBER=${BUILD_NUMBER}" "${tag_args[@]}" .
          # Push only these refs: the daemon is the VM's, so `--all-tags` would also push the local :rollback tag from update.sh.
          for ref in "${refs[@]}"; do docker push "${ref}"; done
          docker logout "${REGISTRY}"
          # Builds run on the VM's daemon: without this its build cache grows until the disk is full.
          docker builder prune -f --filter until=48h >/dev/null 2>&1 || true