name: Container-Image bauen und veröffentlichen

on:
  push:
    branches: [main]
    tags: ["v*"]
  workflow_dispatch:

env:
  REGISTRY: git.jfritzsche.de
  IMAGE_NAME: jf/syncova-policies

jobs:
  build-and-push:
    runs-on: ubuntu-latest

    steps:
      - name: Quellcode auschecken
        uses: actions/checkout@v4

      - name: Image-Tags bestimmen
        id: meta
        run: |
          IMAGE="${REGISTRY}/${IMAGE_NAME}"
          SHA_TAG="${IMAGE}:$(echo "${GITHUB_SHA}" | cut -c1-7)"
          TAGS="-t ${SHA_TAG}"

          case "${GITHUB_REF}" in
            refs/tags/v*)
              VERSION="${GITHUB_REF#refs/tags/}"
              TAGS="${TAGS} -t ${IMAGE}:${VERSION} -t ${IMAGE}:latest"
              ;;
            refs/heads/main)
              TAGS="${TAGS} -t ${IMAGE}:latest"
              ;;
          esac

          echo "tags=${TAGS}" >> "$GITHUB_OUTPUT"
          echo "primary=${SHA_TAG}" >> "$GITHUB_OUTPUT"
          echo "Tags: ${TAGS}"

      # Der Token liegt als Actions-Secret REGISTRY_TOKEN im Repository,
      # nicht im Klartext in dieser Datei.
      - name: An der Registry anmelden
        run: |
          echo "${{ secrets.REGISTRY_TOKEN }}" \
            | docker login "${REGISTRY}" -u "${{ gitea.actor }}" --password-stdin

      - name: Image bauen
        run: docker build ${{ steps.meta.outputs.tags }} .

      - name: Image veröffentlichen
        run: |
          for tag in $(echo "${{ steps.meta.outputs.tags }}" | tr ' ' '\n' | grep -v '^-t$'); do
            echo "Push ${tag}"
            docker push "${tag}"
          done

      - name: Abmelden
        if: always()
        run: docker logout "${REGISTRY}" || true