on:
  push:
    branches: [master]
    paths:
      - Dockerfile
      - "pipelines/**/requirements.txt"
      - .gitea/workflows/build-image.yml
  workflow_dispatch:

jobs:
  build:
    runs-on: ubuntu-latest
    container:
      # Daemonless image builder: kaniko :debug plus the /bin/sleep symlink
      # act needs for job-container PID 1 (see ci/Dockerfile.kaniko-act).
      # No docker socket, no privileges.
      image: pi5-16.local:3005/mikkeli/kaniko-act:v1.23.2

    steps:
      - name: Fetch source, build, push
        # kaniko image has no bash — busybox sh only
        shell: sh
        env:
          PKG_TOKEN: ${{ secrets.PKG_TOKEN }}
          URL_TO_GITEA: ${{ vars.URL_TO_GITEA }}
        run: |
          set -eu
          HOST="${URL_TO_GITEA#http://}"
          SHORT_SHA=$(echo "${GITHUB_SHA}" | cut -c1-7)
          IMAGE="${HOST}/mikkeli/novoyuuparosk-wiki-runner"

          # Source via Gitea archive API (no git/node in this image; repo is
          # public so the download is anonymous — PKG_TOKEN is push-only)
          wget -qO /tmp/src.tar.gz \
            "http://${HOST}/api/v1/repos/mikkeli/novoyuuparosk-auto-wiki/archive/${GITHUB_SHA}.tar.gz"
          mkdir -p /tmp/src
          tar -xzf /tmp/src.tar.gz -C /tmp/src --strip-components=1

          # Registry auth for the push
          AUTH=$(printf '%s' "mikkeli:${PKG_TOKEN}" | base64 | tr -d '\n')
          printf '{"auths":{"%s":{"auth":"%s"}}}' "${HOST}" "${AUTH}" \
            > /kaniko/.docker/config.json

          # --insecure: push target is the plain-HTTP Gitea registry.
          # Base image pull (docker.io) stays HTTPS — no --insecure-pull.
          /kaniko/executor \
            --context dir:///tmp/src \
            --dockerfile /tmp/src/Dockerfile \
            --destination "${IMAGE}:${SHORT_SHA}" \
            --insecure

          echo "Pushed ${IMAGE}:${SHORT_SHA}"