name: Build (and tag) Images

on:
  push:
  workflow_dispatch:

# Images are only published for pushes to the main branch. All other refs (branches,
# renovate branches, tags) are built and tested locally, but never pushed.
#
# Note: a workflow run for a pushed ref uses the workflow file from that ref, so this
# condition alone does not stop someone with push access from publishing images. The
# registry credentials must additionally be restricted to the protected main branch.

env:
  IMAGE_PREFIX: git.hamburg.ccc.de/ccchh/sunders

jobs:
  build:
    runs-on: docker
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Set image tags
        id: vars
        env:
          COMMIT_SHA: ${{ github.sha }}
          PUBLISH: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
        run: |
          if [ "$PUBLISH" = "true" ]; then
            echo "tag=latest" >> "$GITHUB_OUTPUT"
          else
            # Never derive tags from ref names: they are attacker-controlled and may collide with `latest`.
            echo "tag=ci-${COMMIT_SHA}" >> "$GITHUB_OUTPUT"
          fi
          echo "sha_tag=sha-${COMMIT_SHA}" >> "$GITHUB_OUTPUT"

      - name: Build web image
        env:
          TAG: ${{ steps.vars.outputs.tag }}
        run: |
          docker build -f ./Containerfile -t "$IMAGE_PREFIX/web:$TAG" .
        working-directory: ./web

      - name: Build data_handler image
        env:
          TAG: ${{ steps.vars.outputs.tag }}
        run: |
          docker build -f ./Containerfile -t "$IMAGE_PREFIX/data_handler:$TAG" .
        working-directory: ./data_handler

      - name: Update docker-compose.yml image tags
        env:
          TAG: ${{ steps.vars.outputs.tag }}
        run: |
          sed -i "s/:latest/:${TAG}/g" docker-compose.yml

      - name: Start Docker Compose services
        run: |
          docker compose up -d --wait
          docker compose down

      - name: Login to Container Registry
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        uses: docker/login-action@v3
        with:
          registry: git.hamburg.ccc.de
          username: ${{ secrets.REGISTRY_USERNAME }}
          password: ${{ secrets.REGISTRY_TOKEN }}

      - name: Push images to Container Registry
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        env:
          TAG: ${{ steps.vars.outputs.tag }}
          SHA_TAG: ${{ steps.vars.outputs.sha_tag }}
        run: |
          for image in web data_handler; do
            docker tag "$IMAGE_PREFIX/$image:$TAG" "$IMAGE_PREFIX/$image:$SHA_TAG"
            docker push "$IMAGE_PREFIX/$image:$TAG"
            docker push "$IMAGE_PREFIX/$image:$SHA_TAG"
          done