name: CI

# Test on every push/PR; build + push the image only on main.
# The act_runner on .0.2 has the host docker.sock mounted (DOCKER_HOST is
# preset), so plain `docker build`/`docker push` work with no DinD setup.
# Watchtower on .0.2 auto-pulls git.jpaul.io/justin/ag-bids-mcp:latest within
# ~5 min, so a successful push here is the whole deploy.

on:
  push:
    branches: [main]
  pull_request:

env:
  IMAGE: git.jpaul.io/justin/ag-bids-mcp

jobs:
  test:
    runs-on: docker
    steps:
      - uses: actions/checkout@v4
      - name: Install + run tests
        run: |
          # Runner image's system Python is PEP 668 externally-managed, so use a venv.
          python3 -m venv .venv
          . .venv/bin/activate
          pip install --quiet --upgrade pip
          pip install --quiet -r requirements.txt pytest
          pytest -q

  build-push:
    needs: test
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    runs-on: docker
    steps:
      - uses: actions/checkout@v4
      # The auto-provisioned Actions token cannot push packages in this Gitea,
      # so use a PAT (write:package) stored as the REGISTRY_TOKEN repo secret.
      - name: Log in to registry
        run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login git.jpaul.io -u "${{ github.actor }}" --password-stdin
      - name: Build + push
        run: |
          docker build -t "$IMAGE:latest" -t "$IMAGE:${{ github.sha }}" .
          docker push "$IMAGE:latest"
          docker push "$IMAGE:${{ github.sha }}"