name: Container

on:
  push:
    branches: [main]
    tags: ["v*"]
  pull_request:
  workflow_dispatch:

permissions:
  contents: read
  packages: write

concurrency:
  group: container-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  docker:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Fetch AtlasHorizon CAs
        run: sh scripts/refresh-certs.sh

      - name: Registry and image names
        run: |
          REGISTRY="${{ vars.REGISTRY }}"
          if [ -z "$REGISTRY" ]; then
            REGISTRY="${GITHUB_SERVER_URL#https://}"
            REGISTRY="${REGISTRY#http://}"
          fi
          IMAGE="${REGISTRY}/${GITHUB_REPOSITORY,,}"
          echo "REGISTRY=${REGISTRY}" >> "$GITHUB_ENV"
          echo "IMAGE=${IMAGE}" >> "$GITHUB_ENV"
          echo "SHA=$(echo "${GITHUB_SHA}" | cut -c1-7)" >> "$GITHUB_ENV"
          if [ "${{ github.ref }}" = "refs/heads/${{ github.event.repository.default_branch }}" ]; then
            echo "LATEST=true" >> "$GITHUB_ENV"
          else
            echo "LATEST=false" >> "$GITHUB_ENV"
          fi
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            echo "MANUAL=true" >> "$GITHUB_ENV"
          else
            echo "MANUAL=false" >> "$GITHUB_ENV"
          fi

      - uses: docker/setup-buildx-action@v3

      # Gitea job tokens (GITEA_TOKEN / github.token) cannot log into the
      # container registry. A PAT with package read/write is required.
      # https://docs.gitea.com/usage/actions/comparison
      - name: Require registry PAT
        if: github.event_name != 'pull_request'
        env:
          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
        run: |
          if [ -z "$REGISTRY_TOKEN" ]; then
            echo "::error::Add a Gitea PAT with package read/write as the REGISTRY_TOKEN secret (repo or org). Job tokens cannot authenticate to https://${REGISTRY}/v2/."
            exit 1
          fi

      - name: Log in to the Gitea Container Registry
        if: github.event_name != 'pull_request'
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ secrets.REGISTRY_USERNAME || github.actor }}
          password: ${{ secrets.REGISTRY_TOKEN }}

      - name: Build and push
        uses: docker/bake-action@v6
        env:
          IMAGE: ${{ env.IMAGE }}
          LATEST: ${{ env.LATEST }}
          SHA: ${{ env.SHA }}
          MANUAL: ${{ env.MANUAL }}
        with:
          files: docker-bake.hcl
          push: ${{ github.event_name != 'pull_request' }}
          provenance: false