name: Test and publish container images

on:
  push:
    branches:
      - main
  pull_request:

permissions:
  contents: read
  packages: none

env:
  REGISTRY: gitea.incoso.eu
  REGISTRY_OWNER: kevin_janssen

jobs:
  test:
    runs-on: ubuntu-latest
    container:
      image: node:22-bookworm@sha256:5647be709086c696ff32edaaf1c70cd26d1da6ab2b39c32f3c7b4c4a31957e37
    steps:
      - name: Check out source
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4

      - name: Install test dependencies
        run: |
          apt-get update
          apt-get install --yes --no-install-recommends jq python3 python3-pip util-linux
          rm -rf /var/lib/apt/lists/*
          python3 -m pip install \
            --disable-pip-version-check \
            --target .tools/python \
            "osmium==4.3.1"

      - name: Install Node dependencies
        run: npm ci

      - name: Run type checks and tests
        run: |
          npm run typecheck
          npm test

  publish:
    if: ${{ gitea.event_name == 'push' }}
    needs:
      - test
    concurrency:
      group: watermaps-production-publish
      cancel-in-progress: false
    runs-on: ubuntu-latest
    steps:
      - name: Check out source
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4

      - name: Log in to the Gitea Container Registry
        env:
          REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
        run: |
          test -n "$REGISTRY_USERNAME"
          test -n "$REGISTRY_TOKEN"
          printf '%s\n' "$REGISTRY_TOKEN" |
            docker login "$REGISTRY" --username "$REGISTRY_USERNAME" --password-stdin

      - name: Build application images for the triggering commit
        env:
          REVISION: ${{ gitea.sha }}
        run: |
          [[ "$REVISION" =~ ^[0-9a-f]{40}$ ]]
          docker build \
            --label "org.opencontainers.image.revision=$REVISION" \
            --label "org.opencontainers.image.source=https://$REGISTRY/${{ gitea.repository }}" \
            --tag "$REGISTRY/$REGISTRY_OWNER/watermaps:$REVISION" \
            .
          docker build \
            --file deploy/route-data.Dockerfile \
            --label "org.opencontainers.image.revision=$REVISION" \
            --label "org.opencontainers.image.source=https://$REGISTRY/${{ gitea.repository }}" \
            --tag "$REGISTRY/$REGISTRY_OWNER/watermaps-route-data:$REVISION" \
            .

      - name: Push immutable images and build their release manifest
        env:
          REVISION: ${{ gitea.sha }}
        run: |
          set -Eeuo pipefail

          push_and_resolve() {
            local tagged_image="$1"
            local push_output digest repository

            if ! push_output="$(docker push "$tagged_image" 2>&1)"; then
              printf '%s\n' "$push_output" >&2
              return 1
            fi
            printf '%s\n' "$push_output" >&2
            digest="$(
              printf '%s\n' "$push_output" |
                sed -nE 's/.*digest: (sha256:[0-9a-f]{64}).*/\1/p' |
                tail -n 1
            )"
            [[ "$digest" =~ ^sha256:[0-9a-f]{64}$ ]]
            repository="${tagged_image%:*}"
            printf '%s@%s\n' "$repository" "$digest"
          }

          app_image="$(
            push_and_resolve \
              "$REGISTRY/$REGISTRY_OWNER/watermaps:$REVISION"
          )"
          route_data_image="$(
            push_and_resolve \
              "$REGISTRY/$REGISTRY_OWNER/watermaps-route-data:$REVISION"
          )"

          docker build \
            --file deploy/release.Dockerfile \
            --build-arg "REVISION=$REVISION" \
            --build-arg "SOURCE=https://$REGISTRY/${{ gitea.repository }}" \
            --build-arg "APP_IMAGE=$app_image" \
            --build-arg "ROUTE_DATA_IMAGE=$route_data_image" \
            --tag "$REGISTRY/$REGISTRY_OWNER/watermaps-release:$REVISION" \
            .
          docker push "$REGISTRY/$REGISTRY_OWNER/watermaps-release:$REVISION"

      - name: Publish the atomic main release pointer
        env:
          REVISION: ${{ gitea.sha }}
        run: |
          current_main_revision="$(
            git ls-remote --exit-code origin refs/heads/main |
              awk 'NR == 1 { print $1 }'
          )"
          if [[ "$current_main_revision" != "$REVISION" ]]; then
            printf 'Commit %s is no longer the main tip; immutable images stay published without moving main.\n' \
              "$REVISION"
            exit 0
          fi

          docker tag \
            "$REGISTRY/$REGISTRY_OWNER/watermaps-release:$REVISION" \
            "$REGISTRY/$REGISTRY_OWNER/watermaps-release:main"
          docker push "$REGISTRY/$REGISTRY_OWNER/watermaps-release:main"

      - name: Log out from the registry
        if: always()
        run: docker logout "$REGISTRY" || true