name: Docker Image

on:
  push:
    branches:
      - main
      - test
  workflow_dispatch:

jobs:
  publish:
    name: Build and Push Docker Image
    runs-on: gitea-label
    container:
      image: cozsweet-act-runner-node24-docker:latest
    env:
      NEXT_TELEMETRY_DISABLED: "1"
      SENTRY_UPLOAD_SOURCEMAPS: "0"

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Verify Docker
        run: |
          node --version
          pnpm --version
          docker version
          docker info

      - name: Prepare image metadata
        env:
          REGISTRY_IMAGE: ${{ secrets.REGISTRY_IMAGE }}
        run: |
          set -eu

          BRANCH_NAME="${GITHUB_REF_NAME:-}"
          if [ -z "$BRANCH_NAME" ] && [ -n "${GITHUB_REF:-}" ]; then
            BRANCH_NAME="${GITHUB_REF#refs/heads/}"
          fi
          if [ -z "$BRANCH_NAME" ]; then
            BRANCH_NAME="$(git branch --show-current)"
          fi

          SHORT_SHA="$(git rev-parse --short HEAD)"
          case "$BRANCH_NAME" in
            main)
              DEPLOY_ENV="prod"
              NEXT_ENV_FILE=".env.production"
              ;;
            test)
              DEPLOY_ENV="test"
              NEXT_ENV_FILE=".env.local"
              ;;
            *)
              echo "Unsupported branch for image publishing: $BRANCH_NAME" >&2
              exit 1
              ;;
          esac

          if [ -z "$REGISTRY_IMAGE" ]; then
            echo "Missing secret: REGISTRY_IMAGE" >&2
            exit 1
          fi

          {
            echo "BRANCH_NAME=$BRANCH_NAME"
            echo "DEPLOY_ENV=$DEPLOY_ENV"
            echo "NEXT_ENV_FILE=$NEXT_ENV_FILE"
            echo "SHORT_SHA=$SHORT_SHA"
            echo "IMAGE=$REGISTRY_IMAGE"
            echo "IMAGE_VERSION_TAG=$REGISTRY_IMAGE:$DEPLOY_ENV-$SHORT_SHA"
            echo "IMAGE_LATEST_TAG=$REGISTRY_IMAGE:$DEPLOY_ENV-latest"
          } >> "$GITHUB_ENV"

      - name: Prepare build env file
        env:
          TEST_ENV_FILE_CONTENT: ${{ secrets.TEST_ENV_FILE }}
          PRODUCTION_ENV_FILE_CONTENT: ${{ secrets.PRODUCTION_ENV_FILE }}
        run: |
          set -eu

          case "$DEPLOY_ENV" in
            prod)
              if [ -z "$PRODUCTION_ENV_FILE_CONTENT" ]; then
                echo "Missing secret: PRODUCTION_ENV_FILE" >&2
                exit 1
              fi
              printf '%s\n' "$PRODUCTION_ENV_FILE_CONTENT" > "$NEXT_ENV_FILE"
              ;;
            test)
              if [ -z "$TEST_ENV_FILE_CONTENT" ]; then
                echo "Missing secret: TEST_ENV_FILE" >&2
                exit 1
              fi
              printf '%s\n' "$TEST_ENV_FILE_CONTENT" > "$NEXT_ENV_FILE"
              ;;
          esac

      - name: Login Docker registry
        env:
          REGISTRY_HOST: ${{ secrets.REGISTRY_HOST }}
          REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
        run: |
          set -eu

          if [ -z "$REGISTRY_HOST" ] || [ -z "$REGISTRY_USERNAME" ] || [ -z "$REGISTRY_PASSWORD" ]; then
            echo "Missing registry login secrets" >&2
            exit 1
          fi

          printf '%s' "$REGISTRY_PASSWORD" \
            | docker login "$REGISTRY_HOST" -u "$REGISTRY_USERNAME" --password-stdin

      - name: Build Docker image
        run: |
          set -eu

          DOCKER_BUILDKIT=1 docker build \
            --secret id=next_env,src="$NEXT_ENV_FILE" \
            --build-arg NEXT_ENV_FILE="$NEXT_ENV_FILE" \
            -t "$IMAGE_VERSION_TAG" \
            -t "$IMAGE_LATEST_TAG" \
            .

      - name: Push Docker image
        run: |
          set -eu

          docker push "$IMAGE_VERSION_TAG"
          docker push "$IMAGE_LATEST_TAG"

      - name: Cleanup build env file
        if: always()
        run: |
          rm -f .env.local .env.production