name: Build & Push Docker Image
run-name: Build ${{ gitea.ref_name }}

on:
  push:
    branches: [main]
    tags: ["v*"]

jobs:
  build:
    runs-on: ubuntu-latest
    env:
      DOCKER_HOST: tcp://172.17.0.1:2375
    steps:
      - uses: actions/checkout@v4

      - name: Install pnpm
        run: npm install -g pnpm@11.18.0

      - name: Security audit (fails on any prod or high/critical finding)
        run: |
          pnpm audit --prod
          pnpm audit --audit-level high

      - name: Install Docker CLI
        run: |
          apt-get update -qq
          apt-get install -y -qq docker.io
          docker version

      - name: Log in to Gitea Container Registry
        run: |
          echo "${{ secrets.REGISTRY_TOKEN }}" | docker login git.kubebase.de -u ${{ secrets.REGISTRY_USER }} --password-stdin

      - name: Build and push
        run: |
          SHA=$(git rev-parse --short HEAD)
          FULL_SHA=$(git rev-parse HEAD)
          IMAGE="git.kubebase.de/${{ gitea.repository }}"
          DATE_STAMP=$(date -u +"%Y%m%d")
          VERSION="dev-$(date -u +"%Y%m%d-%H%M")"
          TAGS="-t ${IMAGE}:latest"
          if [ "${{ gitea.ref_type }}" = "tag" ]; then
            VERSION="${{ gitea.ref_name }}"
            TAGS="${TAGS} -t ${IMAGE}:${VERSION}"
          fi
          docker build --no-cache \
            --build-arg COMMIT_SHA="$FULL_SHA" \
            --build-arg BUILD_DATE="$(date -u +"%Y-%m-%dT%H:%M:%SZ")" \
            --build-arg VERSION="$VERSION" \
            $TAGS .
          docker push "${IMAGE}:latest"
          if [ "${{ gitea.ref_type }}" = "tag" ]; then
            docker push "${IMAGE}:${VERSION}"
          fi

      - name: Update k8s manifest in admin/apps
        if: gitea.ref_type == 'tag'
        env:
          GITEA_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
        run: |
          SHA=$(git rev-parse --short HEAD)
          NEWTAG="${{ gitea.ref_name }}"
          git clone "https://admin:${GITEA_TOKEN}@git.kubebase.de/admin/apps.git" /tmp/apps
          cd /tmp/apps
          cd apps/system/toolrate/overlays/k3s
          sed -i "s|newTag: .*|newTag: ${NEWTAG}|" kustomization.yaml
          git config user.name "Gitea Actions"
          git config user.email "actions@git.kubebase.de"
          git add -A
          git diff --cached --quiet || git commit -m "chore: update toolrate image to ${NEWTAG}"
          git push