name: build-and-push

# On a version tag push (v*), build both images and publish them to the
# Gitea container registry. Argo CD then rolls them out via
# deploy/helm/pargar (values-apollo.yaml pins the matching image tags).
#
# Requires a registered Gitea Actions runner and `permissions.packages: write`
# so the built-in job token (secrets.GITEA_TOKEN) can push to the registry.

on:
  push:
    tags:
      - "v*"

permissions:
  contents: read
  packages: write

env:
  REGISTRY: src.panahifar.ir
  BACKEND_IMAGE: ahp/pargar-backend
  FRONTEND_IMAGE: ahp/pargar-frontend

jobs:
  build:
    # Gitea runners match on their registered labels (default: linux-amd64)
    runs-on: linux-amd64
    steps:
      - uses: actions/checkout@v4

      - name: Image tag (strip leading v)
        id: meta
        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

      - name: Login to Gitea container registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITEA_TOKEN }}

      - name: Build and push backend
        uses: docker/build-push-action@v6
        with:
          context: ./backend
          push: true
          tags: |
            ${{ env.REGISTRY }}/${{ env.BACKEND_IMAGE }}:${{ steps.meta.outputs.version }}
            ${{ env.REGISTRY }}/${{ env.BACKEND_IMAGE }}:latest

      - name: Build and push frontend
        uses: docker/build-push-action@v6
        with:
          context: ./frontend
          push: true
          # Empty = same-origin API/WS through the Traefik reverse proxy
          # (the production topology). Override via repo variables if needed.
          build-args: |
            NEXT_PUBLIC_API_URL=${{ vars.NEXT_PUBLIC_API_URL }}
            NEXT_PUBLIC_WS_URL=${{ vars.NEXT_PUBLIC_WS_URL }}
          tags: |
            ${{ env.REGISTRY }}/${{ env.FRONTEND_IMAGE }}:${{ steps.meta.outputs.version }}
            ${{ env.REGISTRY }}/${{ env.FRONTEND_IMAGE }}:latest