name: CI

# Test on every push/PR; build + push the image only on main.
# The act_runner on .0.2 has the host docker.sock mounted (DOCKER_HOST is
# preset), so plain `docker build`/`docker push` work with no DinD setup.
# Watchtower on .0.2 auto-pulls git.jpaul.io/justin/ag-bids-mcp:latest within
# ~5 min, so a successful push here is the whole deploy.

on:
  push:
    branches: [main]
  pull_request:

env:
  IMAGE: git.jpaul.io/justin/ag-bids-mcp

jobs:
  test:
    runs-on: docker
    steps:
      - uses: actions/checkout@v4
      - name: Install + run tests
        run: |
          python3 -m pip install --quiet --upgrade pip
          python3 -m pip install --quiet -r requirements.txt pytest
          python3 -m pytest -q

  build-push:
    needs: test
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    runs-on: docker
    steps:
      - uses: actions/checkout@v4
      # Auth to the Gitea container registry. The auto-provisioned job token
      # works for the repo owner's package namespace in the common config; if a
      # run ever fails here with a permissions error, add a repo Actions secret
      # REGISTRY_TOKEN (a PAT with write:package) and swap secrets.GITHUB_TOKEN
      # for secrets.REGISTRY_TOKEN below.
      - name: Log in to registry
        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login git.jpaul.io -u "${{ github.actor }}" --password-stdin
      - name: Build + push
        run: |
          docker build -t "$IMAGE:latest" -t "$IMAGE:${{ github.sha }}" .
          docker push "$IMAGE:latest"
          docker push "$IMAGE:${{ github.sha }}"