name: Tests

on:
  push:
    branches:
      - main
      - master
  pull_request:

jobs:
  test:
    runs-on: ubuntu-latest
    env:
      # Self-hosted Gitea uses an untrusted TLS cert on the runner
      GIT_SSL_NO_VERIFY: "true"

    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          # execa@10 requires Node >=22 (Set.prototype.union)
          node-version: 22
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Typecheck
        run: npm run typecheck

      - name: Build
        run: npm run build

      - name: Run tests
        run: npm run test

  build-and-push-image:
    runs-on: ubuntu-latest
    needs: test
    if: gitea.event_name == 'push'
    env:
      GIT_SSL_NO_VERIFY: "true"

    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Install Docker CLI
        run: |
          # Job runs in node:*-bookworm; CLI is missing even when the host
          # docker.sock is mounted into the container by act_runner.
          apt-get update
          apt-get install -y --no-install-recommends docker.io
          docker version

      - name: Build image metadata
        id: image
        run: |
          REGISTRY="${{ vars.CONTAINER_REGISTRY }}"
          if [ -z "$REGISTRY" ]; then
            REGISTRY="$(printf '%s' '${{ gitea.server_url }}' | sed -E 's#^https?://##; s#/.*$##')"
          fi
          REGISTRY="$(printf '%s' "$REGISTRY" | tr '[:upper:]' '[:lower:]')"
          IMAGE_NAME="$(printf '%s' '${{ gitea.repository }}' | tr '[:upper:]' '[:lower:]')"
          SHORT_SHA="$(printf '%s' '${{ gitea.sha }}' | cut -c1-12)"

          {
            echo "registry=${REGISTRY}"
            echo "image=${REGISTRY}/${IMAGE_NAME}"
            echo "sha_tag=${REGISTRY}/${IMAGE_NAME}:${SHORT_SHA}"
            echo "latest_tag=${REGISTRY}/${IMAGE_NAME}:latest"
          } >> "$GITEA_OUTPUT"

      - name: Log in to Gitea container registry
        run: echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login "${{ steps.image.outputs.registry }}" --username "${{ secrets.REGISTRY_USERNAME }}" --password-stdin

      - name: Build Docker image
        run: |
          # Dockerfile mounts an optional CA secret for npm; provide an empty
          # file so BuildKit does not fail when no corporate CA is needed.
          : > /tmp/empty-ca
          docker build \
            --secret id=ca-cert,src=/tmp/empty-ca \
            --tag "${{ steps.image.outputs.sha_tag }}" \
            --tag "${{ steps.image.outputs.latest_tag }}" \
            .

      - name: Push Docker image
        run: |
          docker push "${{ steps.image.outputs.sha_tag }}"
          docker push "${{ steps.image.outputs.latest_tag }}"