Goff/.gitea/workflows/build-and-push.yml

name: Build and Push Container

on:
  push:
    branches:
    - master
    tags:
    - v*
  workflow_dispatch: null
  pull_request:
    branches:
    - master

concurrency:
  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number
    || github.run_id }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  build-and-push:
    runs-on: butler-ci
    env:
      REGISTRY: gitea.wayfinderak.com
      IMAGE_NAME: gitea.wayfinderak.com/wayfinderak/goff
    container:
      options: --dns 172.16.30.10
    steps:
      - name: Checkout
        uses: https://github.com/actions/checkout@v4

      - name: Select relevant delivery work
        id: delivery
        env:
          DELIVERY_EVENT: ${{ github.event_name }}
          DELIVERY_REF: ${{ github.ref }}
          DELIVERY_SHA: ${{ github.sha }}
          DELIVERY_BASE: ${{ github.event.pull_request.base.sha || github.event.before }}
        run: |
          cd .
          bash scripts/ci-select.sh
      - name: Verify governed runner toolchain
        if: ${{ steps.delivery.outputs.run == 'true' }}
        shell: bash
        run: |
          set -euo pipefail
          test "$(go version)" = 'go version go1.25.13 linux/amd64'
          docker version >/dev/null

      - name: Run tests
        if: ${{ steps.delivery.outputs.run == 'true' }}
        run: go test ./...

      - name: Log in to Gitea Container Registry
        if: ${{ (steps.delivery.outputs.run == 'true') && github.event_name != 'pull_request' }}
        shell: bash
        run: |
          set -euo pipefail
          for attempt in 1 2 3; do
            echo "docker login attempt $attempt"
            if echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login "$REGISTRY" -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin; then
              exit 0
            fi
            sleep 5
          done
          echo "docker login failed after 3 attempts" >&2
          exit 1

      - name: Determine image tags
        if: ${{ steps.delivery.outputs.run == 'true' }}
        id: meta
        shell: bash
        env:
          REF: ${{ gitea.ref }}
          REF_NAME: ${{ gitea.ref_name }}
          SHA: ${{ gitea.sha }}
        run: |
          set -euo pipefail
          tags=("$IMAGE_NAME:sha-$SHA")

          if [[ "$REF" == refs/tags/* ]]; then
            version="$REF_NAME"
            tags+=("$IMAGE_NAME:$version")
            tags+=("$IMAGE_NAME:latest")
          else
            branch="$REF_NAME"
            branch_safe="$(echo "$branch" | tr '/_' '--')"
            sha_short="$(echo "$SHA" | cut -c1-7)"
            tags+=("$IMAGE_NAME:$branch_safe")
            tags+=("$IMAGE_NAME:$branch_safe-$sha_short")
            if [[ "$branch" == "main" || "$branch" == "master" ]]; then
              tags+=("$IMAGE_NAME:latest")
            fi
          fi

          printf 'tags<<EOF\n' >> "$GITHUB_OUTPUT"
          printf '%s\n' "${tags[@]}" >> "$GITHUB_OUTPUT"
          printf 'EOF\n' >> "$GITHUB_OUTPUT"

      - name: Build image
        if: ${{ steps.delivery.outputs.run == 'true' }}
        shell: bash
        run: |
          set -euo pipefail
          mapfile -t tags <<'EOF'
          ${{ steps.meta.outputs.tags }}
          EOF

          build_args=()
          for tag in "${tags[@]}"; do
            build_args+=(--tag "$tag")
          done

          docker build --label "org.opencontainers.image.revision=$GITHUB_SHA" "${build_args[@]}" .

      - name: Push image
        if: ${{ (steps.delivery.outputs.run == 'true') && github.event_name != 'pull_request' }}
        shell: bash
        run: |
          set -euo pipefail
          while IFS= read -r tag; do
            [ -n "$tag" ] || continue
            docker push "$tag"
          done <<'EOF'
          ${{ steps.meta.outputs.tags }}
          EOF