name: Build and Push

on:
  push:
    branches:
      - main

env:
  REGISTRY: git.mcintire.me
  IMAGE_NAME: graham/prop

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build-and-push:
    name: Build and Push Docker Image
    runs-on: ubuntu-22.04

    steps:
      - name: Checkout code
        uses: https://github.com/actions/checkout@v4

      - name: Install Docker CLI
        run: |
          # Dodge apt entirely — the runner image's bookworm repos have been
          # failing GPG verification with "At least one invalid signature".
          # The static Docker client binary talks to the host's daemon socket
          # that act_runner mounts into the job container, which is all we
          # need for `docker build` / `docker push`.
          curl -fsSL -o /tmp/docker.tgz \
            https://download.docker.com/linux/static/stable/x86_64/docker-27.5.1.tgz
          tar xzf /tmp/docker.tgz -C /tmp
          install -m 0755 /tmp/docker/docker /usr/local/bin/docker
          rm -rf /tmp/docker /tmp/docker.tgz
          docker --version

      - name: Generate image tag
        id: tag
        run: |
          TIMESTAMP=$(date +%s)
          SHORT_SHA=$(git rev-parse --short=7 HEAD | cut -c1-7)
          TAG="main-${TIMESTAMP}-${SHORT_SHA}"
          echo "tag=${TAG}" >> $GITHUB_OUTPUT

      - name: Log in to container registry
        run: echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login ${{ secrets.REGISTRY_URL }} -u ${{ secrets.REGISTRY_USER }} --password-stdin

      - name: Build and push Docker image
        run: |
          IMAGE="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}"
          TAG="${{ steps.tag.outputs.tag }}"
          BUILD_TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
          docker build \
            --build-arg BUILD_TIMESTAMP="${BUILD_TIMESTAMP}" \
            -t "${IMAGE}:${TAG}" -t "${IMAGE}:latest" .
          docker push "${IMAGE}:${TAG}"
          docker push "${IMAGE}:latest"