name: Build (and tag) Images

on:
  workflow_dispatch: {}
  push: {}

# Every push builds both images. Only pushes to the main branch publish them, as
# `latest` and `sha-<commit>`; all other refs build without pushing and do not
# receive registry credentials.

jobs:
  build-container:
    name: Build ${{ matrix.image }} Image
    runs-on: docker
    container:
      image: ghcr.io/osscontainertools/kaniko:alpine
    strategy:
      matrix:
        image:
          - web
          - data_handler
    steps:
      - name: Install required system packages
        run: apk add --no-cache nodejs git

      - name: Checkout source code
        uses: actions/checkout@v7

      - name: Build image
        env:
          KANIKO_NO_PUSH: ${{ !(forgejo.event_name == 'push' && forgejo.ref == 'refs/heads/main') }}
          KANIKO_GIT_HAMBURG_CCC_DE_USER: ${{ (forgejo.event_name == 'push' && forgejo.ref == 'refs/heads/main') && secrets.REGISTRY_USERNAME || '' }}
          KANIKO_GIT_HAMBURG_CCC_DE_PASSWORD: ${{ (forgejo.event_name == 'push' && forgejo.ref == 'refs/heads/main') && secrets.REGISTRY_TOKEN || '' }}
        run: /kaniko/executor
          --dockerfile="${{ forgejo.workspace }}/${{ matrix.image }}/Containerfile"
          --context="dir://${{ forgejo.workspace }}/${{ matrix.image }}"
          --destination=git.hamburg.ccc.de/ccchh/sunders/${{ matrix.image }}:latest
          --destination=git.hamburg.ccc.de/ccchh/sunders/${{ matrix.image }}:sha-${{ forgejo.sha }}
          --no-push-cache
          --credential-helpers=env
          --annotation=org.opencontainers.image.ref.name=sunders/${{ matrix.image }}
          --annotation=org.opencontainers.image.revision=${{ forgejo.sha }}
          --annotation=org.opencontainers.image.url=${{ forgejo.server_url }}/${{ forgejo.repository }}
          --annotation=org.opencontainers.image.source=${{ forgejo.server_url }}/${{ forgejo.repository }}

  # Docker Compose smoke test, disabled: the current runner setup cannot execute it.
  # The `docker` runner runs jobs in a container without access to a Docker daemon
  # (which is why images are built with kaniko), so neither `docker build` nor
  # `docker compose` is available. Re-enable this job once a runner with a Docker
  # daemon exists, and set `runs-on` to its label.
  #
  # test-compose:
  #   name: Test with Docker Compose
  #   needs: build-container
  #   runs-on: docker  # needs a runner with a Docker daemon
  #   steps:
  #     - name: Checkout source code
  #       uses: actions/checkout@v7
  #
  #     - name: Build images
  #       run: |
  #         docker build -f web/Containerfile -t git.hamburg.ccc.de/ccchh/sunders/web:ci web
  #         docker build -f data_handler/Containerfile -t git.hamburg.ccc.de/ccchh/sunders/data_handler:ci data_handler
  #
  #     - name: Update docker-compose.yml image tags
  #       run: |
  #         sed -i "s/:latest/:ci/g" docker-compose.yml
  #
  #     - name: Start Docker Compose services
  #       run: |
  #         docker compose up -d --wait
  #         docker compose down