name: Build & Publish
# Fork build pipeline for the "zo" forge (git.ziemlichoptimal.de/moby/brewlog).
# On every push to `dev` this checks the code, then builds the container and
# publishes it to this forge's own container registry. The moby homelab
# (git.ziemlichoptimal.de/moby/cluster-moby) deploys the resulting image via
# Flux GitOps — this pipeline does NOT deploy anything itself (the upstream
# Fly.io deploy step was removed).
on:
  push:
    branches: ["dev"]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

# The registry push uses a PAT with `write:package` scope, supplied via the
# REGISTRY_USER / REGISTRY_TOKEN Actions secrets (same as moby/uberbau_xyz and
# moby/claude-code). Forgejo's auto GITHUB_TOKEN lacks org package-write, so a
# push authenticated with it 401s (reqPackageAccess). `contents: read` keeps the
# Kaniko git-context clone (over the auto token) working; `packages: write` is
# belt-and-suspenders on the auto token.
permissions:
  contents: read
  packages: write

env:
  # This forge's built-in container registry, same host as the git server.
  REGISTRY: git.ziemlichoptimal.de
  IMAGE: git.ziemlichoptimal.de/moby/brewlog

jobs:
  check:
    name: Check
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      # The repo's mise.toml pulls the whole dev toolchain (tailwind, cargo-watch,
      # flyctl, shellcheck, ...), and mise resolves most of those via the GitHub
      # API — which 401s on this runner (it has no github.com token), failing the
      # entire install. CI only needs the pinned Rust toolchain, so install it
      # directly via mise (rust resolves through rustup, no GitHub API).
      - name: Install Rust toolchain
        uses: https://github.com/jdx/mise-action@v2
        with:
          install_args: rust

      - name: Cache Cargo artifacts
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            ~/.cargo/git/db/
            target/
          key: cargo-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}-check
          restore-keys: |
            cargo-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}-
            cargo-${{ runner.os }}-

      # No sudo on the node:20-bookworm runner image (job runs as root). mold is
      # required by .cargo/config.toml's linker flag (-fuse-ld=mold).
      - name: Install system dependencies
        run: apt-get update && apt-get install -y --no-install-recommends clang lld mold pkg-config

      - name: Check formatting
        run: cargo fmt -- --check

      - name: Clippy
        run: cargo clippy -- -D warnings

      - name: Run tests
        run: cargo test -- --show-output

  build:
    name: Build & Publish
    runs-on: ubuntu-latest
    needs: [check]
    # Build the image DAEMONLESS with Kaniko — no Docker, no buildx, no
    # privileged DinD. The job runs *inside* the Kaniko executor image, which
    # builds the Dockerfile and pushes straight to the forge registry.
    container:
      image: gcr.io/kaniko-project/executor:v1.24.0-debug
    defaults:
      run:
        # The kaniko -debug image is busybox-only (no bash).
        shell: sh
    steps:
      - name: Build and push (Kaniko)
        env:
          # Registry push uses a PAT with write:package scope (Forgejo's auto
          # GITHUB_TOKEN lacks org package-write -> 401 reqPackageAccess).
          FORGE_USER: ${{ secrets.REGISTRY_USER }}
          FORGE_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
          # Kaniko clones the `--context` git URL over the auto token (read).
          GIT_USERNAME: ${{ github.actor }}
          GIT_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -eu
          # Registry auth for the push (docker config.json format).
          AUTH=$(printf '%s:%s' "$FORGE_USER" "$FORGE_TOKEN" | base64 | tr -d '\n')
          mkdir -p /kaniko/.docker
          printf '{"auths":{"%s":{"auth":"%s"}}}' "$REGISTRY" "$AUTH" > /kaniko/.docker/config.json
          # Kaniko clones the context itself (this job has no node for JS actions
          # like checkout). `dev` is the moving branch tag; the commit SHA is the
          # immutable ref the moby Deployment pins by digest.
          # The runtime stage is `FROM scratch` + `COPY /rootfs /`, so Kaniko
          # rebuilds the container root. The act runner bind-mounts /var/run/act
          # into the job container; Kaniko can't unlink that busy mount while
          # laying down the rootfs (unlinkat ... device or resource busy), so
          # ignore it. It is a runner artifact and must not be in the image.
          /kaniko/executor \
            --context "git://${REGISTRY}/moby/brewlog.git#refs/heads/dev" \
            --dockerfile Dockerfile \
            --ignore-path=/var/run/act \
            --destination "${IMAGE}:${GITHUB_SHA}" \
            --destination "${IMAGE}:dev"