name: Build Docker Image

# Trigger manually or when a PR to main is completed.
on:
  workflow_dispatch:
  pull_request:
    branches:
      - main
      - develop
    types:
      - closed

jobs:
  build-and-push:
    if: ${{ github.event_name == 'workflow_dispatch' || github.event.pull_request.merged == true }}
    runs-on: ubuntu-latest
    steps:
      # Fetch the repository content for the Docker build context.
      - name: Checkout repository
        uses: actions/checkout@v4

      # Enable Buildx for BuildKit features (incl. SSH mount support).
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      # Authenticate against the container registry before pushing images.
      - name: Log in to container registry
        uses: docker/login-action@v3
        with:
          registry: git.envipath.com
          username: ${{ secrets.CI_REGISTRY_USER }}
          password: ${{ secrets.CI_REGISTRY_PASSWORD }}

      # Generate image tags/labels:
      # - main branch gets stable "envipy" and "latest" tags
      # - every build gets an increasing build number tag
      # - branch-prefixed commit SHA tag remains for traceability
      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: git.envipath.com/envipath/envipy
          tags: |
            type=raw,value=envipy,enable=${{ github.ref_name == 'main' }}
            type=raw,value=latest,enable=${{ github.ref_name == 'main' }}
            type=raw,value=build-${{ github.run_number }}
            type=sha,prefix={{branch}}-

      # Load SSH key so Docker can pull private git+ssh dependencies during build.
      - name: Setup SSH for private git dependencies
        uses: webfactory/ssh-agent@v0.9.0
        with:
          ssh-private-key: ${{ secrets.ENVIPY_CI_PRIVATE_KEY }}

      # Build and push the production image; forward SSH agent without registry cache reuse.
      - name: Build and push Docker image
        uses: docker/build-push-action@v5
        with:
          context: .
          file: Dockerfile
          push: true
          ssh: default
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}