# Publish the immutable crucible:<sha> image on version tags.
# PR/main test builds live in test-image.yml and never publish, so registry
# packages are only generated for releases we intend to use (not on every merge).
#
# Daemonless: the host-mode runner has no container runtime, so the image is
# built by Nix (`nix build .#image`, see flake.nix) and pushed with skopeo
# straight from the OCI tarball. No `docker build`/`docker login` involved.
name: build-image

on:
  push:
    tags: ["v*"]

env:
  REGISTRY: registry.westgate.pw
  IMAGE: deployment/crucible

jobs:
  publish:
    runs-on: nix-docker
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }

      - name: Resolve tag
        id: tag
        run: echo "sha=$(git rev-parse --short=12 HEAD)" >> "$GITHUB_OUTPUT"

      - name: Build OCI image (daemonless)
        run: nix build .#image

      - name: Publish image
        env:
          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
        run: |
          nix shell nixpkgs#skopeo -c skopeo copy \
            --dest-creds "${REGISTRY_USER}:${REGISTRY_PASSWORD}" \
            docker-archive:result \
            "docker://${REGISTRY}/${IMAGE}:${{ steps.tag.outputs.sha }}"

      - name: Emit release fragment
        run: |
          FRAG_REPO=sow-tools \
          FRAG_SHA=${{ steps.tag.outputs.sha }} \
          FRAG_ARTIFACT="${REGISTRY}/${IMAGE}:${{ steps.tag.outputs.sha }}" \
          FRAG_URL="${REGISTRY}/${IMAGE}" \
          FRAG_RUN_ID=${{ gitea.run_id }} \
          bash scripts/emit-release-fragment.sh
      - uses: actions/upload-artifact@v3
        with: { name: release-fragment, path: release-fragment.json }