# Builds and pushes the pass-cli image to code.aneur.in's registry.
#
# Single architecture (amd64) -- the Dockerfile pins a specific
# pass-cli-linux-x86_64 binary, not a TARGETARCH-aware multi-arch build.
#
# Secrets:
#   BUILD_API_TOKEN  registry push token for code.aneur.in (write:package)

name: Build

on:
  push:
    branches: [main]
  workflow_dispatch:

jobs:
  build-and-push:
    runs-on: ubuntu-latest
    container:
      image: docker:cli
    env:
      IMAGE: code.aneur.in/${{ gitea.repository }}
    steps:
      - name: Install toolchain deps
        run: apk add --no-cache nodejs docker-cli-buildx

      - uses: actions/checkout@v4

      - name: Log in to the container registry
        env:
          BUILD_API_TOKEN: ${{ secrets.BUILD_API_TOKEN }}
        run: echo "$BUILD_API_TOKEN" | docker login code.aneur.in -u "${{ gitea.actor }}" --password-stdin

      - name: Promote current "latest" to "previous"
        run: |
          if docker buildx imagetools inspect "$IMAGE:latest" >/dev/null 2>&1; then
            docker buildx imagetools create -t "$IMAGE:previous" "$IMAGE:latest"
          else
            echo "No existing :latest to promote; skipping."
          fi

      - name: Build and push "latest"
        run: |
          docker build -t "$IMAGE:latest" .
          docker push "$IMAGE:latest"