name: Docker

on:
  pull_request:
    branches: [main]
    paths:
      - "docker/**"
      - ".github/workflows/docker.yml"
  push:
    branches: [main]
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      paseo_version:
        description: "Paseo npm version to build for validation. Defaults to latest."
        required: false
        default: ""

concurrency:
  group: docker-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

env:
  REGISTRY: ghcr.io
  PLATFORMS: linux/amd64,linux/arm64

jobs:
  setup:
    runs-on: ubuntu-latest
    outputs:
      image: ${{ steps.values.outputs.image }}
      install_version: ${{ steps.values.outputs.install_version }}
      publish: ${{ steps.values.outputs.publish }}
      check_tag: ${{ steps.values.outputs.check_tag }}
      publish_tags: ${{ steps.values.outputs.publish_tags }}
    steps:
      - uses: actions/checkout@v6

      - id: values
        env:
          INPUT_PASEO_VERSION: ${{ inputs.paseo_version }}
          REPO_OWNER: ${{ github.repository_owner }}
          REF_NAME: ${{ github.ref_name }}
        run: |
          set -euo pipefail

          owner="$(printf '%s' "${REPO_OWNER}" | tr '[:upper:]' '[:lower:]')"
          image="ghcr.io/${owner}/paseo"
          install_version="${INPUT_PASEO_VERSION:-latest}"
          publish=false

          if [[ "${GITHUB_REF}" == refs/tags/v* ]]; then
            install_version="${REF_NAME#v}"
            if [[ "${REF_NAME}" != *-* ]]; then
              publish=true
            fi
          fi

          check_tag="${image}:check-${GITHUB_SHA::12}"
          publish_tags="${image}:${install_version}"$'\n'"${image}:latest"

          {
            echo "image=${image}"
            echo "install_version=${install_version}"
            echo "publish=${publish}"
            echo "check_tag=${check_tag}"
            echo "publish_tags<<EOF"
            echo "${publish_tags}"
            echo "EOF"
          } >> "$GITHUB_OUTPUT"

          echo "Resolved image=${image} install_version=${install_version} publish=${publish}"

  build:
    needs: setup
    if: needs.setup.outputs.publish != 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v6

      - uses: docker/setup-qemu-action@v4
      - uses: docker/setup-buildx-action@v4

      - uses: docker/build-push-action@v7
        with:
          context: docker/base
          file: docker/base/Dockerfile
          platforms: ${{ env.PLATFORMS }}
          build-args: |
            PASEO_VERSION=${{ needs.setup.outputs.install_version }}
          tags: ${{ needs.setup.outputs.check_tag }}
          push: false
          provenance: false
          cache-from: type=gha,scope=paseo
          cache-to: type=gha,scope=paseo,mode=max

  publish:
    needs: setup
    if: needs.setup.outputs.publish == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v6

      - uses: docker/setup-qemu-action@v4
      - uses: docker/setup-buildx-action@v4

      - name: Log in to GHCR
        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - uses: docker/build-push-action@v7
        with:
          context: docker/base
          file: docker/base/Dockerfile
          platforms: ${{ env.PLATFORMS }}
          build-args: |
            PASEO_VERSION=${{ needs.setup.outputs.install_version }}
          tags: ${{ needs.setup.outputs.publish_tags }}
          push: true
          provenance: false
          cache-from: type=gha,scope=paseo
          cache-to: type=gha,scope=paseo,mode=max