name: Publish cloudflare-balancer Docker image

on:
  push:
    branches:
      - '**'
    tags:
      - '*'
  workflow_dispatch:

env:
  # Хост Container Registry (без схемы), тот же что для docker pull/push
  REGISTRY: git.shts.su
  IMAGE_REPO: ${{ gitea.repository }}

jobs:
  build-and-push:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      contents: read
      packages: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          driver-opts: |
            image=moby/buildkit:v0.13.2

      # Пароль registry — встроенный токен job (packages: write), без отдельного PAT
      - name: Log in to Gitea Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ gitea.actor }}
          password: ${{ secrets.PACKAGE_TOKEN }}

      - name: Prepare Docker tags
        id: prep
        shell: bash
        env:
          REPO: ${{ gitea.repository }}
          SHA: ${{ gitea.sha }}
          REF_NAME: ${{ gitea.ref_name }}
        run: |
          set -euo pipefail
          IMAGE="${REGISTRY}/${REPO}"
          BRANCH_OR_TAG="${REF_NAME:-unknown}"
          SAFE_REF="$(echo "${BRANCH_OR_TAG}" | tr '/' '-')"
          SHORT_SHA="$(echo "${SHA}" | cut -c1-12)"

          TAGS="$(printf '%s\n%s\n%s\n' \
            "${IMAGE}:latest" \
            "${IMAGE}:${SAFE_REF}" \
            "${IMAGE}:sha-${SHORT_SHA}")"

          echo "tags<<EOF" >> "${GITHUB_OUTPUT}"
          echo "${TAGS}" >> "${GITHUB_OUTPUT}"
          echo "EOF" >> "${GITHUB_OUTPUT}"

      - name: Build and push Docker image
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./Dockerfile
          push: true
          platforms: linux/amd64
          cache-from: |
            type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_REPO }}:latest
          cache-to: type=inline
          tags: ${{ steps.prep.outputs.tags }}
          labels: |
            org.opencontainers.image.title=cloudflare-balancer
            org.opencontainers.image.description=Health-check бэкендов и синхронизация пула A/AAAA в Cloudflare DNS
            org.opencontainers.image.revision=${{ gitea.sha }}
            org.opencontainers.image.source=${{ gitea.server_url }}/${{ gitea.repository }}
          provenance: false

      # Секрет CONTAINER_UPDATE_URL — URL webhook (например Portainer: обычно GET по уникальной ссылке)
      - name: Webhook обновления контейнера
        env:
          CONTAINER_UPDATE_URL: ${{ secrets.CONTAINER_UPDATE_URL }}
        run: |
          set -e
          if [ -z "${CONTAINER_UPDATE_URL:-}" ]; then
            echo "CONTAINER_UPDATE_URL не задан — шаг пропущен."
            exit 0
          fi
          curl -fsS -m 120 "${CONTAINER_UPDATE_URL}"