name: Build (and tag) Images

on:
  push:
  workflow_dispatch:

# Images are only published for pushes to the main branch. All other refs (branches,
# renovate branches, tags) are built, but never pushed, and do not get registry credentials.
#
# Note: a workflow run for a pushed ref uses the workflow file from that ref, so this
# condition alone does not stop someone with push access from publishing images. The
# registry credentials must additionally be restricted to the protected main branch.

env:
  IMAGE_PREFIX: git.hamburg.ccc.de/ccchh/sunders

jobs:
  build:
    runs-on: docker
    container:
      image: ghcr.io/osscontainertools/kaniko:alpine
    steps:
      - name: Install required system packages
        run: apk add --no-cache nodejs git

      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set image tags
        id: vars
        env:
          COMMIT_SHA: ${{ forgejo.sha }}
          PUBLISH: ${{ forgejo.event_name == 'push' && forgejo.ref == 'refs/heads/main' }}
        run: |
          if [ "$PUBLISH" = "true" ]; then
            echo "publish=true" >> "$GITHUB_OUTPUT"
            echo "tag=latest" >> "$GITHUB_OUTPUT"
          else
            echo "publish=false" >> "$GITHUB_OUTPUT"
            # Never derive tags from ref names: they are attacker-controlled and may collide with `latest`.
            echo "tag=ci-${COMMIT_SHA}" >> "$GITHUB_OUTPUT"
          fi
          echo "sha_tag=sha-${COMMIT_SHA}" >> "$GITHUB_OUTPUT"

      - name: Build web image
        env:
          IMAGE: web
          PUBLISH: ${{ steps.vars.outputs.publish }}
          TAG: ${{ steps.vars.outputs.tag }}
          SHA_TAG: ${{ steps.vars.outputs.sha_tag }}
          KANIKO_GIT_HAMBURG_CCC_DE_USER: ${{ steps.vars.outputs.publish == 'true' && secrets.REGISTRY_USERNAME || '' }}
          KANIKO_GIT_HAMBURG_CCC_DE_PASSWORD: ${{ steps.vars.outputs.publish == 'true' && secrets.REGISTRY_TOKEN || '' }}
        run: |
          if [ "$PUBLISH" = "true" ]; then
            set -- --destination="$IMAGE_PREFIX/$IMAGE:$TAG" --destination="$IMAGE_PREFIX/$IMAGE:$SHA_TAG"
          else
            set -- --destination="$IMAGE_PREFIX/$IMAGE:$TAG" --no-push
          fi
          /kaniko/executor \
            --dockerfile="$GITHUB_WORKSPACE/$IMAGE/Containerfile" \
            --context="dir://$GITHUB_WORKSPACE/$IMAGE" \
            --no-push-cache \
            --credential-helpers=env \
            "$@"

      - name: Build data_handler image
        env:
          IMAGE: data_handler
          PUBLISH: ${{ steps.vars.outputs.publish }}
          TAG: ${{ steps.vars.outputs.tag }}
          SHA_TAG: ${{ steps.vars.outputs.sha_tag }}
          KANIKO_GIT_HAMBURG_CCC_DE_USER: ${{ steps.vars.outputs.publish == 'true' && secrets.REGISTRY_USERNAME || '' }}
          KANIKO_GIT_HAMBURG_CCC_DE_PASSWORD: ${{ steps.vars.outputs.publish == 'true' && secrets.REGISTRY_TOKEN || '' }}
        run: |
          if [ "$PUBLISH" = "true" ]; then
            set -- --destination="$IMAGE_PREFIX/$IMAGE:$TAG" --destination="$IMAGE_PREFIX/$IMAGE:$SHA_TAG"
          else
            set -- --destination="$IMAGE_PREFIX/$IMAGE:$TAG" --no-push
          fi
          /kaniko/executor \
            --dockerfile="$GITHUB_WORKSPACE/$IMAGE/Containerfile" \
            --context="dir://$GITHUB_WORKSPACE/$IMAGE" \
            --no-push-cache \
            --credential-helpers=env \
            "$@"