name: Build and Push

on:
  push:
    branches:
      - main

env:
  REGISTRY: git.mcintire.me
  OWNER: graham
  IMAGE_NAME: prop
  DOCKER_CLI_VERSION: '28.5.2'
  BUILDX_VERSION: '0.35.0'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build-and-push:
    name: Build and Push Docker Image
    runs-on: ubuntu-latest

    services:
      postgres:
        image: postgres:17-alpine
        env:
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: postgres
        ports:
          - 5432:5432
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Install Docker CLI and buildx
        # The runner automounts the host Docker socket, so we only need the
        # client. No Kaniko, no build action.
        run: |
          set -euo pipefail
          curl -fsSL --retry 3 --retry-delay 2 \
            "https://download.docker.com/linux/static/stable/x86_64/docker-${DOCKER_CLI_VERSION}.tgz" \
            | tar xz --strip-components=1 -C /usr/local/bin docker/docker
          # Docker 23+ routes `docker build` through buildx. The static tarball
          # ships only the CLI, so the plugin has to be installed separately or
          # DOCKER_BUILDKIT=1 fails with "buildx component is missing".
          mkdir -p "$HOME/.docker/cli-plugins"
          curl -fsSL --retry 3 --retry-delay 2 \
            -o "$HOME/.docker/cli-plugins/docker-buildx" \
            "https://github.com/docker/buildx/releases/download/v${BUILDX_VERSION}/buildx-v${BUILDX_VERSION}.linux-amd64"
          chmod +x "$HOME/.docker/cli-plugins/docker-buildx"
          docker version
          docker buildx version

      - name: Verify compilation
        run: |
          set -euo pipefail
          # Pipe the workspace into the container via stdin instead of a volume
          # mount, because the runner is itself a container whose filesystem the
          # host Docker daemon cannot see.
          tar --exclude='_build' --exclude='deps' --exclude='.git' \
              --exclude='priv/static/assets' --exclude='assets/node_modules' \
              --exclude='rust' --exclude='target' \
              -cf - . | \
          docker run --rm -i \
            -e MIX_ENV=prod \
            -w /app \
            docker.io/hexpm/elixir:1.20.1-erlang-29.0.2-debian-trixie-20260518-slim \
            sh -euc '\
              mkdir -p /app && cd /app && tar xf - && \
              apt-get update -qq && apt-get install -y -qq git curl ca-certificates build-essential && \
              mix local.hex --force && \
              mix local.rebar --force && \
              mix deps.get --only prod && \
              mix deps.compile && \
              mix assets.setup && \
              mix compile --warnings-as-errors'

      - name: Run tests
        run: |
          set -euo pipefail
          tar --exclude='_build' --exclude='deps' --exclude='.git' \
              --exclude='priv/static/assets' --exclude='assets/node_modules' \
              --exclude='rust' --exclude='target' \
              -cf - . | \
          docker run --rm -i \
            -e MIX_ENV=test \
            --network host \
            -w /app \
            docker.io/hexpm/elixir:1.20.1-erlang-29.0.2-debian-trixie-20260518-slim \
            sh -euc '\
              mkdir -p /app && cd /app && tar xf - && \
              apt-get update -qq && apt-get install -y -qq git curl ca-certificates build-essential && \
              mix local.hex --force && \
              mix local.rebar --force && \
              mix deps.get && \
              mix ecto.create --quiet && \
              mix ecto.migrate --quiet && \
              mix test'

      - name: Build and push
        env:
          REGISTRY_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
        run: |
          set -euo pipefail

          IMAGE="${REGISTRY}/${OWNER}/${IMAGE_NAME}"
          SHA_TAG="main-$(date -u +%s)-${GITHUB_SHA::7}"

          echo "$REGISTRY_TOKEN" | docker login "$REGISTRY" -u "$OWNER" --password-stdin

          # One build, both tags. This was previously two invocations of a build
          # action, i.e. the whole image was compiled twice just to add `latest`.
          DOCKER_BUILDKIT=1 docker build \
            --build-arg BUILDKIT_INLINE_CACHE=1 \
            --cache-from "${IMAGE}:latest" \
            --tag "${IMAGE}:${SHA_TAG}" \
            --tag "${IMAGE}:latest" \
            .

          docker push "${IMAGE}:${SHA_TAG}"
          docker push "${IMAGE}:latest"

          {
            echo "### Image pushed"
            echo ""
            echo "- \`${IMAGE}:${SHA_TAG}\`"
            echo "- \`${IMAGE}:latest\`"
          } >> "$GITHUB_STEP_SUMMARY"

          docker image rm "${IMAGE}:${SHA_TAG}" "${IMAGE}:latest" 2>/dev/null || true
          docker logout "$REGISTRY" || true