#
# .gitea/workflows/dnsmasq-image.yaml
#
# Builds the serving-stack dnsmasq image (serving/dnsmasq) and pushes it to the
# registry, so serving hosts `docker compose pull` it instead of building it at
# deploy time (matching the SPDK image). The image is GENERIC: it carries no
# Secure Boot keys and no iPXE binary — the signed snponly.efi rides the separate
# fleet-ipxe image (ipxe-image.yaml), mounted into dnsmasq at /ipxe.
#
# Runs only when the dnsmasq image inputs change (path filter) or on demand.
#
# Required Gitea repo secrets: PACKAGE_USER, PACKAGE_TOKEN (registry creds).
#

name: Build dnsmasq image
run-name: ${{ gitea.actor }} builds the serving dnsmasq image
on:
  push:
    branches:
      - "main"
    paths:
      - "serving/dnsmasq/**"
      - ".gitea/workflows/dnsmasq-image.yaml"
  workflow_dispatch:

env:
  DNSMASQ_IMAGE: "git.bitasylum.org/audiobuzz/fleet-dnsmasq"

jobs:
  dnsmasq-build:
    name: Build & push dnsmasq image
    runs-on: ubuntu-latest
    container:
      image: git.bitasylum.org/audiobuzz/ubuntu-act-runner-qemu:main
    steps:
      -
        name: Checkout
        uses: actions/checkout@v6

      -
        name: Install buildah
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends buildah

      -
        name: Registry login
        run: |
          buildah login \
            --username "${{ secrets.PACKAGE_USER }}" \
            --password "${{ secrets.PACKAGE_TOKEN }}" \
            git.bitasylum.org

      -
        name: Build & push
        # vfs storage: overlay-on-overlayfs is unsupported in-container.
        env:
          STORAGE_DRIVER: vfs
          BUILDAH_ISOLATION: chroot
        run: |
          SHA="${{ gitea.sha }}"; SHA="${SHA:0:7}"
          echo "Building ${DNSMASQ_IMAGE}:${SHA} (+ :latest)"
          buildah bud \
            -t "${DNSMASQ_IMAGE}:${SHA}" \
            -t "${DNSMASQ_IMAGE}:latest" \
            serving/dnsmasq
          buildah push "${DNSMASQ_IMAGE}:${SHA}"
          buildah push "${DNSMASQ_IMAGE}:latest"