name: Build and Push Container Image

on:
  push:
    branches:
      - main
      - multilingual
      - redesign
    tags:
      - 'v*'
  workflow_dispatch:

jobs:
  build-and-push:
    name: Build & Push to Gitea Package Registry
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Ensure Container Build Tools (Docker CLI / Buildah)
        run: |
          if ! command -v docker >/dev/null 2>&1; then
            echo "Docker CLI not found in runner image; installing static Docker CLI..."
            curl -fsSL https://download.docker.com/linux/static/stable/x86_64/docker-27.3.1.tgz | tar xz -C /tmp
            mv /tmp/docker/docker /usr/local/bin/docker
            chmod +x /usr/local/bin/docker
            rm -rf /tmp/docker
          fi
          docker --version

      - name: Build, Validate, and Push Image to Gitea Package Registry
        env:
          REGISTRY_USER: ${{ gitea.actor }}
          REGISTRY_TOKEN: ${{ secrets.GITEATOKEN }}
          SERVER_URL: ${{ gitea.server_url }}
          REPO_NAME: ${{ gitea.repository }}
          REF_NAME: ${{ gitea.ref_name }}
          SHA: ${{ gitea.sha }}
        run: |
          REGISTRY_HOST=$(echo "${SERVER_URL}" | sed -E 's#^https?://##; s#/$##')
          IS_HTTP=false
          if echo "${SERVER_URL}" | grep -qE '^http://'; then
            IS_HTTP=true
          fi

          IMAGE_PATH=$(echo "${REPO_NAME}" | tr '[:upper:]' '[:lower:]')
          FULL_IMAGE="${REGISTRY_HOST}/${IMAGE_PATH}"
          SHORT_SHA=$(echo "${SHA}" | cut -c1-7)
          SAFE_REF=$(echo "${REF_NAME}" | sed -E 's#[^a-zA-Z0-9_.-]#-#g')

          if docker info >/dev/null 2>&1; then
            echo "Using Docker daemon via mounted socket..."
            docker build --pull \
              -t "${FULL_IMAGE}:${SAFE_REF}" \
              -t "${FULL_IMAGE}:${SHORT_SHA}" \
              -t "${FULL_IMAGE}:latest" \
              .

            echo "Validating PHP syntax inside built container..."
            docker run --rm "${FULL_IMAGE}:${SHORT_SHA}" sh -c 'find /var/www/html -name "*.php" -exec php -l {} +'

            echo "Attempting Docker login to ${REGISTRY_HOST}..."
            if echo "${REGISTRY_TOKEN}" | docker login "${SERVER_URL}" -u "${REGISTRY_USER}" --password-stdin 2>/dev/null \
               || echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY_HOST}" -u "${REGISTRY_USER}" --password-stdin 2>/dev/null; then
              echo "Pushing tags via Docker CLI..."
              docker push "${FULL_IMAGE}:${SAFE_REF}"
              docker push "${FULL_IMAGE}:${SHORT_SHA}"
              docker push "${FULL_IMAGE}:latest"
            else
              echo "Docker daemon rejected login (plain HTTP registry ${SERVER_URL} not in host insecure-registries)."
              echo "Exporting built image with Docker CLI and pushing via skopeo..."
              if ! command -v skopeo >/dev/null 2>&1; then
                apt-get update && apt-get install -y skopeo
              fi
              TLS_FLAG="--dest-tls-verify=true"
              if [ "${IS_HTTP}" = "true" ]; then
                TLS_FLAG="--dest-tls-verify=false"
              fi
              docker save "${FULL_IMAGE}:${SHORT_SHA}" -o /tmp/image.tar
              for TAG in "${SAFE_REF}" "${SHORT_SHA}" "latest"; do
                echo "Pushing ${FULL_IMAGE}:${TAG}..."
                skopeo copy ${TLS_FLAG} \
                  --dest-creds "${REGISTRY_USER}:${REGISTRY_TOKEN}" \
                  "docker-archive:/tmp/image.tar" \
                  "docker://${FULL_IMAGE}:${TAG}"
              done
              rm -f /tmp/image.tar
            fi
          else
            echo "Docker socket (/var/run/docker.sock) is not mounted in this runner container."
            echo "Falling back to daemonless Buildah..."
            if ! command -v buildah >/dev/null 2>&1; then
              apt-get update && apt-get install -y buildah
            fi
            TLS_FLAG="--tls-verify=true"
            if [ "${IS_HTTP}" = "true" ]; then
              TLS_FLAG="--tls-verify=false"
            fi
            buildah bud --storage-driver=vfs --isolation=chroot --pull \
              -t "${FULL_IMAGE}:${SAFE_REF}" \
              -t "${FULL_IMAGE}:${SHORT_SHA}" \
              -t "${FULL_IMAGE}:latest" \
              .
            for TAG in "${SAFE_REF}" "${SHORT_SHA}" "latest"; do
              buildah push --storage-driver=vfs ${TLS_FLAG} \
                --creds "${REGISTRY_USER}:${REGISTRY_TOKEN}" \
                "${FULL_IMAGE}:${TAG}" \
                "docker://${FULL_IMAGE}:${TAG}"
            done
          fi