name: release
on:
  push:
    branches: [main]

# ponytail: only because Traefik still serves its default self-signed cert for
# git.kessinen.com. Remove once the LE-DNS01-cloudflare runbook has been run.
env:
  GIT_SSL_NO_VERIFY: "true"
  REGISTRY: git.kessinen.com
  IMAGE: git.kessinen.com/kessinen/foodster

jobs:
  image:
    runs-on: ubuntu-latest
    steps:
      # Full history and tags: the release number is derived by counting the
      # tags already cut today.
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      # The job container is node:22-bookworm and has no docker client. The
      # static binary is one file; installing docker.io would pull a daemon
      # that is never used, since the build runs against the host's.
      - name: Install the docker client
        run: |
          curl -fsSL https://download.docker.com/linux/static/stable/x86_64/docker-27.3.1.tgz \
            | tar xz --strip-components=1 -C /usr/local/bin docker/docker
          docker version --format '{{.Client.Version}}'

      - name: Work out the release tag
        id: rel
        run: |
          day=$(date +%Y%m%d)
          tag="v$day-$(( $(git tag -l "v$day-*" | wc -l) + 1 ))"
          echo "tag=$tag" >> "$GITHUB_OUTPUT"
          echo "==> $tag"

      - name: Tag the commit
        run: |
          git tag "${{ steps.rel.outputs.tag }}"
          git push origin "${{ steps.rel.outputs.tag }}"

      - name: Log in to the registry
        run: |
          echo "${{ secrets.GITEA_TOKEN }}" \
            | docker login "$REGISTRY" -u "${{ gitea.actor }}" --password-stdin

      - name: Build and push
        run: |
          tag="${{ steps.rel.outputs.tag }}"
          docker build --platform linux/amd64 --build-arg VERSION="$tag" \
            -f Containerfile \
            -t "$IMAGE:$tag" -t "$IMAGE:latest" .
          docker push "$IMAGE:$tag"
          docker push "$IMAGE:latest"
          echo "pushed $IMAGE:$tag and :latest - pull it in dockge when ready"