name: Build and Push Container Image

on:
  push:
    tags:
      - 'v*.*.*'
  workflow_dispatch:

env:
  REGISTRY: gitea.nehmer.net/torben
  IMAGE_NAME: gitea-mcp-auth-proxy

jobs:
  build-and-push-image:
    runs-on: container-builder
    container:
      image: debian:trixie-slim
    steps:
      - name: Install CI Dependencies
        run: |
          apt-get update
          apt-get install -y --no-install-recommends git nodejs curl docker-cli docker-buildx unzip ca-certificates iproute2 gawk

      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Load Secrets from 1Password
        uses: 1password/load-secrets-action@v2
        with:
          export-env: true
        env:
          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
          REGISTRY_USER: op://CI-CD/gitea-package-token/username
          REGISTRY_PAT: op://CI-CD/gitea-package-token/password

      - name: BuildKit Setup (Remote Builder konfigurieren)
        run: |
          HOST_IP=$(ip route | awk '/default/ { print $3 }')
          docker buildx create --name remote-builder --driver remote tcp://$HOST_IP:1234 --use --bootstrap

      - name: Log in to the Container registry
        run: |
          echo "$REGISTRY_PAT" | docker login $REGISTRY -u "$REGISTRY_USER" --password-stdin

      - name: Build and Push
        run: |
          TAG="${{ gitea.ref_name }}"

          # Note: This repository only builds and pushes images.
          # FluxCD Image Automation in another repository performs deployment.
          # Stable tags (vX.Y.Z) also publish :latest.
          # Pre-release tags (e.g. vX.Y.Z-rc1) also publish :prerelease-tag.
          if printf '%s' "$TAG" | grep -Eq '^v[0-9]+\.[0-9]+\.[0-9]+$'; then
            docker buildx build \
              --platform linux/amd64 \
              --push \
              --tag "$REGISTRY/$IMAGE_NAME:$TAG" \
              --tag "$REGISTRY/$IMAGE_NAME:latest" \
              .
          else
            docker buildx build \
              --platform linux/amd64 \
              --push \
              --tag "$REGISTRY/$IMAGE_NAME:$TAG" \
              --tag "$REGISTRY/$IMAGE_NAME:prerelease-tag" \
              .
          fi