name: build-and-push

# On a version tag push (v*), build both images and publish them to the
# Gitea container registry. Argo CD then rolls them out via
# deploy/helm/pargar (values-apollo.yaml pins the matching image tags).
#
# Requires a registered Gitea Actions runner and `permissions.packages: write`
# so the built-in job token (secrets.GITEA_TOKEN) can push to the registry.

on:
  push:
    tags:
      - "v*"

permissions:
  contents: read
  packages: write

env:
  REGISTRY: src.panahifar.ir
  BACKEND_IMAGE: ahp/pargar-backend
  FRONTEND_IMAGE: ahp/pargar-frontend
  # Single credential location shared by login + build steps (the job runs
  # in a container whose HOME can differ between steps).
  DOCKER_CONFIG: /tmp/.docker

jobs:
  build:
    # Gitea runners match on their registered labels (default: linux-amd64)
    runs-on: linux-amd64
    steps:
      - uses: actions/checkout@v4

      - name: Image tag (strip leading v)
        id: meta
        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

      # The job container (node:20-bookworm) ships no docker CLI, and builds
      # run against the runner host's daemon (docker-outside-of-docker), so
      # the socket must be mounted by the runner config.
      - name: Set up Docker CLI (not shipped in job container)
        run: |
          set -eu
          if [ ! -S /var/run/docker.sock ]; then
            echo "::error::/var/run/docker.sock is not mounted in the job container - add 'options: -v /var/run/docker.sock:/var/run/docker.sock' and 'valid_volumes: [/var/run/docker.sock]' under 'container:' in the act_runner config.yaml, then restart the runner."
            exit 1
          fi
          curl -fsSL "https://download.docker.com/linux/static/stable/x86_64/docker-27.5.1.tgz" | tar xz --strip-components=1 -C /usr/local/bin docker/docker
          mkdir -p /root/.docker/cli-plugins
          curl -fsSL "https://github.com/docker/buildx/releases/download/v0.19.3/buildx-v0.19.3.linux-amd64" -o /root/.docker/cli-plugins/docker-buildx
          chmod +x /root/.docker/cli-plugins/docker-buildx
          docker version

      - name: Login to Gitea container registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITEA_TOKEN }}

      - name: Build and push backend
        uses: docker/build-push-action@v6
        with:
          context: ./backend
          push: true
          tags: |
            ${{ env.REGISTRY }}/${{ env.BACKEND_IMAGE }}:${{ steps.meta.outputs.version }}
            ${{ env.REGISTRY }}/${{ env.BACKEND_IMAGE }}:latest

      - name: Build and push frontend
        uses: docker/build-push-action@v6
        with:
          context: ./frontend
          push: true
          # Empty = same-origin API/WS through the Traefik reverse proxy
          # (the production topology). Override via repo variables if needed.
          build-args: |
            NEXT_PUBLIC_API_URL=${{ vars.NEXT_PUBLIC_API_URL }}
            NEXT_PUBLIC_WS_URL=${{ vars.NEXT_PUBLIC_WS_URL }}
          tags: |
            ${{ env.REGISTRY }}/${{ env.FRONTEND_IMAGE }}:${{ steps.meta.outputs.version }}
            ${{ env.REGISTRY }}/${{ env.FRONTEND_IMAGE }}:latest