name: Build Images

# Only images whose files changed get built. A release is cut by pushing a tag
# named <image>/vX.Y.Z, which publishes that one image.
on:
  push:
    branches: [main]
    tags: ["*/v*"]
  pull_request:
    branches: [main]
  workflow_dispatch:
    inputs:
      image:
        description: Image to build, or "all"
        default: all
        required: true

concurrency:
  group: build-${{ github.ref }}
  cancel-in-progress: true

env:
  REGISTRY: gitea.libretechconsulting.com
  NAMESPACE: rmcguire
  DOCKER_USER: rmcguire

jobs:
  select:
    name: Select images
    runs-on: ubuntu-latest
    outputs:
      images: ${{ steps.select.outputs.images }}
      any: ${{ steps.select.outputs.any }}
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0 # need history to diff against the base commit

      - id: select
        run: ./hack/select-images.sh >> "$GITHUB_OUTPUT"
        env:
          DISPATCH_IMAGE: ${{ github.event.inputs.image }}
          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}

  build:
    name: ${{ matrix.image }}
    needs: select
    if: needs.select.outputs.any == 'true'
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        image: ${{ fromJSON(needs.select.outputs.images) }}
    steps:
      - uses: actions/checkout@v7

      - id: meta
        run: ./hack/docker-tags.sh '${{ matrix.image }}' >> "$GITHUB_OUTPUT"
        env:
          PR_NUMBER: ${{ github.event.pull_request.number }}

      - uses: docker/setup-buildx-action@v4

      # Loaded rather than pushed, so the smoke test runs before anything is
      # published. provenance is off because Gitea's registry rejects buildkit
      # attestation manifests.
      - name: Build
        uses: docker/build-push-action@v7
        with:
          context: images/${{ matrix.image }}
          load: true
          tags: ${{ steps.meta.outputs.tags }}
          provenance: false
          build-args: |
            VERSION=${{ steps.meta.outputs.version }}
            REVISION=${{ github.sha }}
            CREATED=${{ steps.meta.outputs.created }}

      - name: Smoke test
        run: make test IMAGE='${{ matrix.image }}' REF='${{ steps.meta.outputs.primary }}'

      - name: Log in to ${{ env.REGISTRY }}
        if: steps.meta.outputs.push == 'true'
        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ env.DOCKER_USER }}
          password: ${{ secrets.API_TOKEN }}

      - name: Push
        if: steps.meta.outputs.push == 'true'
        run: printf '%s\n' '${{ steps.meta.outputs.tags }}' | xargs -r -n1 -t docker push