# Publishing / Releases
#
# Trigger: push to main — i.e. when any PR merges.
# Image: git.bergerhouse.net/luckberg/familysync-api
# Tags:
#   :latest                        — moving pointer for easy pulls
#   :<MILESTONE>-<shortsha>        — immutable, rollback-traceable (e.g. v1.1-98acff8)
#
# Required secret: REGISTRY_PAT — a Gitea Actions secret holding a PAT with write:package scope.
# Named REGISTRY_PAT (not GITEA_*): Gitea reserves the GITEA_ prefix for secret names, so
# GITEA_-prefixed names cannot be created. GITEA_TOKEN / GITHUB_TOKEN cannot push packages.
#
# Safety gate: branch protection on main, NOT a needs: dependency in this file.
# The PR test jobs (fast-checks, api, harness in ci.yml) run on pull_request — they never
# run in the same workflow invocation as publish.yml. Tests gate the PR; main is trusted to
# be green because direct push and force push are blocked and the three required checks
# (CI / fast-checks, CI / api, CI / harness) must pass before merge.
#
# To bump the milestone tag at a milestone boundary: edit MILESTONE below.

name: Publish

on:
  push:
    branches: [main]

env:
  MILESTONE: v1.1

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      # Compute both image tags per D-04:
      #   :latest        — moving pointer for easy pulls
      #   :<milestone>-<shortsha> — immutable, rollback-traceable (e.g. v1.1-4303a1b)
      # GITHUB_SHA is confirmed available in Gitea Actions (probe P-13).
      # MILESTONE is read from the workflow-level env var (set to v1.1 above) — update at milestone boundaries.
      - name: Compute image tags
        id: tags
        run: |
          set -euo pipefail
          # Fail closed if GITHUB_SHA is empty/unset (Gitea runner env parity is not
          # guaranteed across versions). Without this guard SHORT_SHA degrades to ""
          # and the immutable tag silently becomes :v1.1- — a valid-but-wrong tag that
          # overwrites the milestone pointer and destroys rollback traceability (WR-03).
          : "${GITHUB_SHA:?GITHUB_SHA is empty — refusing to build a malformed image tag}"
          SHORT_SHA=${GITHUB_SHA:0:7}
          MILESTONE="${{ env.MILESTONE }}"
          echo "latest=git.bergerhouse.net/luckberg/familysync-api:latest" >> $GITHUB_OUTPUT
          echo "sha_tag=git.bergerhouse.net/luckberg/familysync-api:${MILESTONE}-${SHORT_SHA}" >> $GITHUB_OUTPUT

      # Pitfall 13 (load-bearing security step): PAT piped via stdin — never via -p/--password.
      # GITEA_TOKEN/GITHUB_TOKEN cannot push packages; a PAT with write:package scope is required
      # (confirmed: Gitea forum + registry docs). Token is masked by Gitea's secret-log scrubber
      # and never echoed elsewhere or set as a plain env var.
      # Secret is named REGISTRY_PAT (not GITEA_REGISTRY_PAT): Gitea reserves the GITEA_ prefix
      # for secret names, so the GITEA_-prefixed name cannot be created.
      - name: Docker login
        # Bind the secret through env: so it is never substituted into the rendered
        # script body. Read it as $REGISTRY_PAT and pipe with printf '%s' (echo is not
        # safe for arbitrary strings — a trailing newline or shell-significant char
        # would mangle the password into a confusing `unauthorized`) (WR-05).
        env:
          REGISTRY_PAT: ${{ secrets.REGISTRY_PAT }}
        run: |
          set -euo pipefail
          printf '%s' "$REGISTRY_PAT" | \
          docker login git.bergerhouse.net \
            --username luckberg \
            --password-stdin

      # Build from REPO ROOT (T-08-10): the Dockerfile copies the pnpm workspace manifest +
      # lockfile from the root context; building from apps/api/ would fail to find them.
      - name: Build and push
        run: |
          docker build --target production \
            -f apps/api/Dockerfile \
            -t ${{ steps.tags.outputs.latest }} \
            -t ${{ steps.tags.outputs.sha_tag }} \
            .
          docker push ${{ steps.tags.outputs.latest }}
          docker push ${{ steps.tags.outputs.sha_tag }}

      # Always drop the stored credential from the runner after push (defence in depth).
      - name: Docker logout
        if: always()
        run: docker logout git.bergerhouse.net || true