#
# .gitea/workflows/fleet-manager-image.yaml
#
# Builds the serving-stack fleet-manager image (serving/fleet-manager) and pushes
# it to the registry, so mgmt hosts `docker compose pull` it instead of building
# it at deploy time (matching the dnsmasq / SPDK / kiosk images). The multi-stage
# Dockerfile builds the Svelte SPA (node) → dist/, compiles the Go binary with the
# SPA embedded (`-tags embedspa`), and ships FROM distroless static (nonroot). The
# gRPC .pb.go stubs are committed, so no protoc is needed here.
#
# NOTE on base images: the build/ui stages pull the golang + node bases from the
# harbor mirror; the runtime is gcr.io/distroless/static-debian12:nonroot. The
# runner needs reach to harbor + gcr.io (mirror distroless through harbor too if
# egress is restricted).
#
# Tagging mirrors gitea-main-ci.yaml so every branch builds a uniquely tagged,
# pushed image you can test without clobbering main:
#   - tag push    (refs/tags/v1.2.3) -> "1.2.3"          (+ :latest)
#   - main push   (refs/heads/main)  -> "main-<sha7>"    (+ :latest)
#   - branch push (refs/heads/<x>)   -> "<x>-<sha7>"     (dev image, no :latest)
# Set FLEET_MANAGER_VERSION in serving/fleet-manager/.env to the tag you want to run.
#
# Runs only when the fleet-manager image inputs change (path filter) or on demand.
#
# Required Gitea repo secrets: PACKAGE_USER, PACKAGE_TOKEN (registry creds).
#

name: Build fleet-manager image
run-name: ${{ gitea.actor }} builds the fleet-manager control-plane image (${{ gitea.ref_name }})
on:
  push:
    branches:
      - "**"      # every branch — dev branches get a branch-name+sha tag
    tags:
      - "v*"      # tag push -> clean semver tag (v1.2.3 -> 1.2.3)
    paths:
      - "serving/fleet-manager/**"
      - ".gitea/workflows/fleet-manager-image.yaml"
  workflow_dispatch:

# One build per ref at a time; a newer push to the same ref cancels the in-flight.
concurrency:
  group: fleet-manager-image-${{ gitea.ref }}
  cancel-in-progress: true

env:
  FLEET_MANAGER_IMAGE: "git.bitasylum.org/audiobuzz/fleet-manager"

jobs:
  fleet-manager-build:
    name: Build & push fleet-manager image
    runs-on: ubuntu-latest
    container:
      image: git.bitasylum.org/audiobuzz/ubuntu-act-runner-qemu:main
    steps:
      -
        name: Checkout
        uses: actions/checkout@v6

      -
        name: Derive image tag
        id: vars
        # Same scheme as gitea-main-ci.yaml: clean semver on a tag push, else
        # "<branch>-<sha7>" with the branch sanitized to the OCI tag charset.
        run: |
          short_sha="$(echo "${GITHUB_SHA}" | cut -c1-7)"
          if [ "${GITHUB_REF#refs/tags/}" != "$GITHUB_REF" ]; then
            version="${GITHUB_REF#refs/tags/}"; version="${version#v}"
          else
            branch="${GITHUB_REF#refs/heads/}"
            safe_branch="$(printf '%s' "$branch" \
              | sed -e 's#[^A-Za-z0-9._-]#-#g' -e 's#^[.-]*##' | cut -c1-100)"
            [ -n "$safe_branch" ] || safe_branch="branch"
            version="${safe_branch}-${short_sha}"
          fi
          echo "version=${version}" >> "$GITHUB_OUTPUT"
          echo "Building ${FLEET_MANAGER_IMAGE}:${version}"

      -
        name: Install buildah
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends buildah

      -
        name: Registry login
        run: |
          buildah login \
            --username "${{ secrets.PACKAGE_USER }}" \
            --password "${{ secrets.PACKAGE_TOKEN }}" \
            git.bitasylum.org

      -
        name: Build & push
        # vfs storage: overlay-on-overlayfs is unsupported in-container.
        env:
          STORAGE_DRIVER: vfs
          BUILDAH_ISOLATION: chroot
        run: |
          VER="${{ steps.vars.outputs.version }}"
          buildah bud -t "${FLEET_MANAGER_IMAGE}:${VER}" serving/fleet-manager
          buildah push "${FLEET_MANAGER_IMAGE}:${VER}"
          # Only main / release tags move :latest, so dev branches never clobber it.
          case "$GITHUB_REF" in
            refs/heads/main|refs/tags/*)
              buildah tag  "${FLEET_MANAGER_IMAGE}:${VER}" "${FLEET_MANAGER_IMAGE}:latest"
              buildah push "${FLEET_MANAGER_IMAGE}:latest"
              echo "Updated ${FLEET_MANAGER_IMAGE}:latest" ;;
            *)
              echo "Dev branch build — :latest left untouched (run with FLEET_MANAGER_VERSION=${VER})" ;;
          esac