name: Build (and tag) Images

on:
  workflow_dispatch: {}
  push: {}

# Every push builds both images. Only pushes to the main branch publish them, as
# `latest` and `sha-<commit>`; all other refs build without pushing and do not
# receive registry credentials.

jobs:
  build-container:
    name: Build ${{ matrix.image }} Image
    runs-on: docker
    container:
      image: ghcr.io/osscontainertools/kaniko:alpine
    strategy:
      matrix:
        image:
          - web
          - data_handler
    steps:
      - name: Install required system packages
        run: apk add --no-cache nodejs git

      - name: Checkout source code
        uses: actions/checkout@v7

      - name: Build image
        env:
          KANIKO_NO_PUSH: ${{ !(forgejo.event_name == 'push' && forgejo.ref == 'refs/heads/main') }}
          KANIKO_GIT_HAMBURG_CCC_DE_USER: forgejo-actions
          KANIKO_GIT_HAMBURG_CCC_DE_PASSWORD: ${{ (forgejo.event_name == 'push' && forgejo.ref == 'refs/heads/main') && secrets.PACKAGES_TOKEN || '' }}
        run: /kaniko/executor
          --dockerfile="${{ forgejo.workspace }}/${{ matrix.image }}/Containerfile"
          --context="dir://${{ forgejo.workspace }}/${{ matrix.image }}"
          --destination=git.hamburg.ccc.de/ccchh/sunders/${{ matrix.image }}:latest
          --destination=git.hamburg.ccc.de/ccchh/sunders/${{ matrix.image }}:sha-${{ forgejo.sha }}
          --no-push-cache
          --credential-helpers=env
          --annotation=org.opencontainers.image.ref.name=sunders/${{ matrix.image }}
          --annotation=org.opencontainers.image.revision=${{ forgejo.sha }}
          --annotation=org.opencontainers.image.url=${{ forgejo.server_url }}/${{ forgejo.repository }}
          --annotation=org.opencontainers.image.source=${{ forgejo.server_url }}/${{ forgejo.repository }}