name: Build and push image

# The app image only provides PHP/Apache/extensions — application code is bind-
# mounted from ./src at deploy time (see compose.yaml), so this only needs to
# run when the image definition itself changes, not on every app code change.
on:
  push:
    branches: [main]
    paths:
      - Dockerfile
      - .gitea/workflows/build.yml

permissions:
  contents: read
  packages: write

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Verify registry credentials are configured
        run: |
          if [ -z "${{ secrets.REGISTRY_TOKEN }}" ]; then
            echo "::error::Secret REGISTRY_TOKEN is not set, so login to gitea.kzbikowski.pl would fail. Create a Gitea access token with 'write:package' (and 'read:package') scope — user Settings > Applications > Generate New Token — then add it as an Actions secret named REGISTRY_TOKEN under this repo's Settings > Actions > Secrets. Aborting before attempting login." >&2
            exit 1
          fi

      - name: Log in to Gitea container registry
        uses: docker/login-action@v3
        with:
          registry: gitea.kzbikowski.pl
          username: ${{ github.actor }}
          password: ${{ secrets.REGISTRY_TOKEN }}

      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ./Dockerfile
          push: true
          tags: |
            gitea.kzbikowski.pl/kzbkowski/servicedesk:latest
            gitea.kzbikowski.pl/kzbkowski/servicedesk:${{ github.sha }}