name: Publish Hugo Deployment Image

on:
  push:
    branches:
      - main
  workflow_dispatch:
    inputs:
      image_tag:
        description: Image tag to publish
        required: false
        type: string
      publish_latest:
        description: Also update latest
        required: false
        type: boolean
        default: false

concurrency:
  group: publish-image-${{ forgejo.repository }}
  cancel-in-progress: false

jobs:
  publish:
    runs-on: docker-desktop
    env:
      EVENT_NAME: ${{ forgejo.event_name }}
      REGISTRY_HOST: ${{ vars.REGISTRY_HOST }}
      REGISTRY_USERNAME: ${{ vars.REGISTRY_USERNAME }}
      IMAGE_REPO: cliper/hugo-deployment
      IMAGE_TAG: ${{ inputs.image_tag != '' && inputs.image_tag || forgejo.sha }}
      PUBLISH_LATEST: ${{ inputs.publish_latest }}
    steps:
      - name: Checkout repository
        uses: https://data.forgejo.org/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5

      - name: Validate registry configuration
        env:
          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
        run: |
          set -euo pipefail
          test -n "${REGISTRY_HOST:-}" || { echo "Missing REGISTRY_HOST" >&2; exit 1; }
          test -n "${REGISTRY_USERNAME:-}" || { echo "Missing REGISTRY_USERNAME" >&2; exit 1; }
          test -n "${REGISTRY_PASSWORD:-}" || { echo "Missing REGISTRY_PASSWORD" >&2; exit 1; }

      - name: Validate image tag
        run: |
          set -euo pipefail
          printf '%s' "$IMAGE_TAG" | grep -Eq '^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$' || {
            echo "Invalid IMAGE_TAG: $IMAGE_TAG" >&2
            exit 1
          }

      - name: Log in to registry
        env:
          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
        run: |
          set -euo pipefail
          printf '%s' "$REGISTRY_PASSWORD" | docker login "$REGISTRY_HOST" -u "$REGISTRY_USERNAME" --password-stdin

      - name: Build image
        run: |
          set -euo pipefail
          docker build \
            -t "${REGISTRY_HOST}/${IMAGE_REPO}:${IMAGE_TAG}" \
            -t "${REGISTRY_HOST}/${IMAGE_REPO}:latest" \
            .

      - name: Push image tags
        run: |
          set -euo pipefail
          docker push "${REGISTRY_HOST}/${IMAGE_REPO}:${IMAGE_TAG}"
          if [ "${EVENT_NAME:-}" = "push" ] || [ "${PUBLISH_LATEST:-false}" = "true" ]; then
            docker push "${REGISTRY_HOST}/${IMAGE_REPO}:latest"
          fi