name: Container Image

on:
  push:
    branches:
      - dev
      - main
      - master
  workflow_dispatch:

permissions:
  contents: read
  packages: write

concurrency:
  group: container-image-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build-and-push:
    runs-on: ubuntu-latest
    env:
      REGISTRY: git.wilkensxl.de
      IMAGE_NAME: odysseus
      FALLBACK_OWNER: mrsphay
      REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
      ACTIONS_TOKEN: ${{ gitea.token }}
      SECRET_GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5

      - name: Check Docker
        run: docker version

      - name: Build and push image
        shell: bash
        run: |
          set -euo pipefail

          owner="${GITHUB_REPOSITORY_OWNER:-MrSphay}"
          registry_user="${REGISTRY_USER:-${owner}}"
          image_owner="$(printf '%s' "${owner:-${FALLBACK_OWNER}}" | tr '[:upper:]' '[:lower:]')"
          image="${REGISTRY}/${image_owner}/${IMAGE_NAME}"
          short_sha="$(printf '%s' "${GITHUB_SHA}" | cut -c1-7)"
          ref_name="${GITHUB_REF_NAME:-dev}"
          ref_tag="$(printf '%s' "${ref_name}" | tr '[:upper:]' '[:lower:]' | tr -cs 'a-z0-9._-' '-' | sed 's/^-//; s/-$//')"

          login_ok=false
          for token_name in REGISTRY_TOKEN ACTIONS_TOKEN SECRET_GITEA_TOKEN; do
            token_value="${!token_name:-}"
            if [ -z "${token_value}" ]; then
              continue
            fi

            echo "Trying registry login with ${token_name} as ${registry_user}."
            if echo "${token_value}" | docker login "${REGISTRY}" --username "${registry_user}" --password-stdin; then
              login_ok=true
              break
            fi

            docker logout "${REGISTRY}" >/dev/null 2>&1 || true
          done

          if [ "${login_ok}" != "true" ]; then
            echo "Registry login failed. Configure REGISTRY_TOKEN with package read/write access, or allow packages: write for the repository GITEA_TOKEN."
            exit 1
          fi

          docker build --pull \
            --tag "${image}:sha-${short_sha}" \
            --tag "${image}:${ref_tag}" \
            --tag "${image}:latest" \
            .

          docker push "${image}:sha-${short_sha}"
          docker push "${image}:${ref_tag}"
          docker push "${image}:latest"

          {
            echo "Published image tags:"
            echo "- ${image}:latest"
            echo "- ${image}:${ref_tag}"
            echo "- ${image}:sha-${short_sha}"
          } >> "${GITHUB_STEP_SUMMARY}"