name: build-and-push

# On a version tag push (v*), build both images and publish them to the
# Gitea container registry. Argo CD then rolls them out via
# deploy/helm/pargar (values-apollo.yaml pins the matching image tags).
#
# Requires a registered Gitea Actions runner, a `REGISTRY_TOKEN` secret
# (Gitea access token with write:package scope) so docker login can push to
# the registry.

on:
  push:
    tags:
      - "v*"

permissions:
  contents: read
  packages: write

env:
  REGISTRY: src.panahifar.ir
  BACKEND_IMAGE: ahp/pargar-backend
  FRONTEND_IMAGE: ahp/pargar-frontend
  # Single credential location shared by login + build steps (the job runs
  # in a container whose HOME can differ between steps).
  DOCKER_CONFIG: /tmp/.docker

jobs:
  build:
    # Gitea runners match on their registered labels (default: linux-amd64)
    runs-on: linux-amd64
    steps:
      - uses: actions/checkout@v4

      - name: Image tag (strip leading v)
        id: meta
        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

      # Builds run docker-outside-of-docker through the runner-mounted
      # /var/run/docker.sock. The apollo runner's job image (act-job:20,
      # .gitea/job-image) already ships the docker CLI + buildx in system
      # plugin paths; runners on other networks fall back to installing them
      # at runtime (needs access to download.docker.com + github.com, and the
      # plugin must land where docker looks with DOCKER_CONFIG set).
      - name: Set up Docker CLI (preinstalled on apollo; install elsewhere)
        run: |
          set -eu
          if [ ! -S /var/run/docker.sock ]; then
            echo "::error::/var/run/docker.sock is not mounted in the job container - the act_runner config must mount it (docker_host: \"\" auto-mounts it)."
            exit 1
          fi
          if ! command -v docker >/dev/null 2>&1 || ! docker buildx version >/dev/null 2>&1; then
            curl -fsSL "https://download.docker.com/linux/static/stable/x86_64/docker-27.5.1.tgz" | tar xz --strip-components=1 -C /usr/local/bin docker/docker
            mkdir -p /root/.docker/cli-plugins /usr/local/libexec/docker/cli-plugins
            curl -fsSL "https://github.com/docker/buildx/releases/download/v0.19.3/buildx-v0.19.3.linux-amd64" -o /root/.docker/cli-plugins/docker-buildx
            cp /root/.docker/cli-plugins/docker-buildx /usr/local/libexec/docker/cli-plugins/docker-buildx
            chmod +x /root/.docker/cli-plugins/docker-buildx /usr/local/libexec/docker/cli-plugins/docker-buildx
          fi
          docker version
          docker buildx version

      - name: Login to Gitea container registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.REGISTRY_TOKEN }}

      - name: Build and push backend
        uses: docker/build-push-action@v6
        with:
          context: ./backend
          push: true
          tags: |
            ${{ env.REGISTRY }}/${{ env.BACKEND_IMAGE }}:${{ steps.meta.outputs.version }}
            ${{ env.REGISTRY }}/${{ env.BACKEND_IMAGE }}:latest

      - name: Build and push frontend
        uses: docker/build-push-action@v6
        with:
          context: ./frontend
          push: true
          # Empty = same-origin API/WS through the Traefik reverse proxy
          # (the production topology). Override via repo variables if needed.
          build-args: |
            NEXT_PUBLIC_API_URL=${{ vars.NEXT_PUBLIC_API_URL }}
            NEXT_PUBLIC_WS_URL=${{ vars.NEXT_PUBLIC_WS_URL }}
          tags: |
            ${{ env.REGISTRY }}/${{ env.FRONTEND_IMAGE }}:${{ steps.meta.outputs.version }}
            ${{ env.REGISTRY }}/${{ env.FRONTEND_IMAGE }}:latest