name: Docker

# Publishes the container image (linux/amd64 and linux/arm64):
#   push to main   ->  :edge and :sha-<commit>
#   tag v1.2.3     ->  :1.2.3, :1.2 and :latest   (pre-releases like v1.2.3-rc1 get only :1.2.3-rc1)
# Run it by hand from the Actions tab to rebuild the current branch.
#
# Settings (all optional):
#   secret   REGISTRY_TOKEN   access token with package write permission, if the job token can't push
#   variable REGISTRY_USER    user for that token (defaults to the person who triggered the run)
#   variable MIRROR_IMAGE     also push to another registry, e.g. ghcr.io/you/spinner or docker.io/you/spinner
#   secret   MIRROR_TOKEN     and variable MIRROR_USER: login for that registry
#   variable PUBLISH_DOCKER   set to "false" to skip this workflow
on:
  push:
    branches: [main]
    tags: ['v*']
  workflow_dispatch:

jobs:
  image:
    if: ${{ vars.PUBLISH_DOCKER != 'false' }}
    runs-on: ubuntu-latest
    env:
      GOPRIVATE: git.veillax.com
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: actions/setup-go@v5
        with:
          go-version-file: go.mod

      - name: Let Go fetch modules from this server
        run: git config --global url."https://x-access-token:${{ secrets.GITHUB_TOKEN }}@git.veillax.com/".insteadOf "https://git.veillax.com/"

      - name: Test
        run: |
          go vet ./...
          go test ./...

      # The Dockerfile packages these binaries, so the image needs no Go toolchain or emulation.
      - name: Build the binaries
        env:
          TARGETS: linux/amd64 linux/arm64
        run: sh deploy/build.sh

      - name: Log in
        env:
          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN || secrets.GITHUB_TOKEN }}
          REGISTRY_USER: ${{ vars.REGISTRY_USER || github.actor }}
          MIRROR_IMAGE: ${{ vars.MIRROR_IMAGE }}
          MIRROR_USER: ${{ vars.MIRROR_USER }}
          MIRROR_TOKEN: ${{ secrets.MIRROR_TOKEN }}
        run: |
          host=${GITHUB_SERVER_URL#*://}
          echo "$REGISTRY_TOKEN" | docker login "$host" -u "$REGISTRY_USER" --password-stdin
          if [ -n "$MIRROR_IMAGE" ]; then
            echo "$MIRROR_TOKEN" | docker login "${MIRROR_IMAGE%%/*}" -u "$MIRROR_USER" --password-stdin
          fi

      - name: Build and push
        env:
          MIRROR_IMAGE: ${{ vars.MIRROR_IMAGE }}
        run: |
          host=${GITHUB_SERVER_URL#*://}
          owner=$(echo "$GITHUB_REPOSITORY_OWNER" | tr 'A-Z' 'a-z')
          images="$host/$owner/spinner"
          [ -n "$MIRROR_IMAGE" ] && images="$images $MIRROR_IMAGE"

          if [ "$GITHUB_REF_TYPE" = tag ]; then
            v=${GITHUB_REF_NAME#v}
            tags="$v"
            case "$v" in
              *-*) ;; # pre-releases don't move :1.2 or :latest
              *) tags="$tags ${v%.*} latest" ;;
            esac
          else
            tags="edge sha-$(echo "$GITHUB_SHA" | cut -c1-7)"
          fi

          args=""
          for i in $images; do for t in $tags; do args="$args -t $i:$t"; done; done
          docker buildx create --name spinner --driver docker-container --use >/dev/null 2>&1 || docker buildx use spinner
          echo "pushing:$args"
          docker buildx build --platform linux/amd64,linux/arm64 $args --push .