name: CI

on:
  push:
    branches: [main]
    tags: ["v*"]
  pull_request:
    branches: [main]

env:
  REGISTRY: git.clortox.com

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      # Tests run inside the same Python version the image ships, without
      # depending on what the runner happens to have installed.
      - name: Run test suite
        run: |
          docker run --rm -v "$PWD:/src" -w /src python:3.14-slim \
            sh -c 'pip install --no-cache-dir -e ".[dev]" && python -m pytest -q'

  image:
    runs-on: ubuntu-latest
    needs: test
    if: github.event_name == 'push'
    steps:
      - uses: actions/checkout@v4

      - name: Derive image name and tags
        id: meta
        run: |
          set -eu
          image="$REGISTRY/$(echo "$GITHUB_REPOSITORY" | tr '[:upper:]' '[:lower:]')"
          tags="$image:${GITHUB_SHA:0:7}"

          case "$GITHUB_REF" in
            refs/heads/main)
              tags="$tags,$image:latest"
              ;;
            refs/tags/v*)
              version="${GITHUB_REF#refs/tags/v}"
              tags="$tags,$image:$version"
              # v1.2.3 also moves the 1.2 and 1 pointers.
              case "$version" in
                *.*.*)
                  tags="$tags,$image:${version%.*},$image:${version%%.*}"
                  ;;
              esac
              ;;
          esac

          echo "image=$image" >> "$GITHUB_OUTPUT"
          echo "tags=$tags"   >> "$GITHUB_OUTPUT"
          echo "Tagging: $tags"

      - name: Log in to the Gitea container registry
        run: |
          echo "${{ secrets.GITEA_TOKEN }}" \
            | docker login "$REGISTRY" -u "${{ github.actor }}" --password-stdin

      - name: Build and push
        run: |
          set -eu
          args=""
          for tag in $(echo "${{ steps.meta.outputs.tags }}" | tr ',' ' '); do
            args="$args -t $tag"
          done
          # shellcheck disable=SC2086
          docker build $args \
            --label "org.opencontainers.image.source=$GITHUB_SERVER_URL/$GITHUB_REPOSITORY" \
            --label "org.opencontainers.image.revision=$GITHUB_SHA" \
            .
          for tag in $(echo "${{ steps.meta.outputs.tags }}" | tr ',' ' '); do
            docker push "$tag"
          done

      - name: Smoke-test the pushed image
        run: |
          set -eu
          image="${{ steps.meta.outputs.image }}:${GITHUB_SHA:0:7}"
          mkdir -p /tmp/smoke/daily
          printf -- '- [ ] [#A] ci smoke task\n' > /tmp/smoke/daily/notes.md
          docker run --rm -v /tmp/smoke:/vault "$image" \
            mdcaldav --vault /vault scan | grep -q 'ci smoke task'
          echo "image runs and parses a vault"

      - name: Log out
        if: always()
        run: docker logout "$REGISTRY" || true