name: Docker

on:
  push:
    branches:
      - master
    tags:
      - v*

jobs:
  docker:
    name: Build and publish worker image
    runs-on: ubuntu-latest
    env:
      HARBOR_REGISTRY: ${{ secrets.HARBOR_REGISTRY }}
      HARBOR_PROJECT: rsmon
      IMAGE_NAME: rsmon-worker

    steps:
      - name: Check out code
        uses: actions/checkout@v4

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Normalize Harbor registry
        id: registry
        shell: bash
        run: |
          REGISTRY="${HARBOR_REGISTRY,,}"
          REGISTRY="${REGISTRY#http://}"
          REGISTRY="${REGISTRY#https://}"
          while [ "${REGISTRY%/}" != "${REGISTRY}" ]; do
            REGISTRY="${REGISTRY%/}"
          done
          if [[ ! "${REGISTRY}" =~ ^[a-z0-9.-]+(:[0-9]+)?$ ]]; then
            echo "HARBOR_REGISTRY must contain only a registry host and optional port" >&2
            exit 1
          fi
          echo "host=${REGISTRY}" >> "${GITHUB_OUTPUT}"

      - name: Log in to Harbor
        uses: docker/login-action@v3
        with:
          registry: ${{ steps.registry.outputs.host }}
          username: ${{ secrets.HARBOR_USER }}
          password: ${{ secrets.HARBOR_PASSWORD }}

      - name: Compute image metadata
        id: vars
        env:
          REGISTRY: ${{ steps.registry.outputs.host }}
          REF_NAME: ${{ gitea.ref_name }}
          REF_TYPE: ${{ gitea.ref_type }}
          SHA: ${{ gitea.sha }}
        run: |
          IMAGE="${REGISTRY}/${HARBOR_PROJECT}/${IMAGE_NAME}"
          SHORT_SHA="$(printf '%s' "${SHA}" | cut -c1-12)"
          TAGS="${IMAGE}:sha-${SHORT_SHA}"
          if [ "${REF_TYPE}" = "branch" ] && [ "${REF_NAME}" = "master" ]; then
            TAGS="${TAGS},${IMAGE}:latest"
          fi
          if [ "${REF_TYPE}" = "tag" ]; then
            RELEASE_TAG="$(printf '%s' "${REF_NAME}" | tr -c 'A-Za-z0-9_.-' '-' | cut -c1-128)"
            TAGS="${TAGS},${IMAGE}:${RELEASE_TAG}"
          fi
          {
            echo "image=${IMAGE}"
            echo "tags=${TAGS}"
            echo "build_date=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
          } >> "${GITHUB_OUTPUT}"

      - name: Build and push image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ./Dockerfile
          platforms: linux/amd64,linux/arm64
          pull: true
          push: true
          tags: ${{ steps.vars.outputs.tags }}
          labels: |
            org.opencontainers.image.source=${{ gitea.server_url }}/${{ gitea.repository }}
            org.opencontainers.image.revision=${{ gitea.sha }}
            org.opencontainers.image.version=${{ gitea.ref_name }}
            org.opencontainers.image.licenses=LicenseRef-RSMon-Worker-Source-Available-1.0
          build-args: |
            VERSION=${{ gitea.ref_name }}
            COMMIT=${{ gitea.sha }}
            BUILD_DATE=${{ steps.vars.outputs.build_date }}
          cache-from: type=registry,ref=${{ steps.vars.outputs.image }}:buildcache
          cache-to: type=registry,ref=${{ steps.vars.outputs.image }}:buildcache,mode=max
          sbom: true
          provenance: mode=max