name: build-frontend

# Builds + pushes the Next.js image to justin/provenance-frontend's package area
# on Gitea on every merge to main. Servers pull from git.jpaul.io.
#
# Push -> LAN registry 192.168.0.2:1234 (plain HTTP); pull -> git.jpaul.io.
# Mirrors the drawbar setup; see build-backend.yml for the rationale.
#
# Tag scheme: test-main | test-sha-<long> | <version from package.json> | latest (v* tags)

on:
  workflow_dispatch:
  push:
    branches: [main]
    tags: ['v*']
    paths:
      - 'frontend/**'
      - '.gitea/workflows/build-frontend.yml'

concurrency:
  group: build-frontend-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build:
    runs-on: docker
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Extract version from package.json
        id: ver
        run: |
          v=$(grep -oP '"version"\s*:\s*"\K[^"]+' frontend/package.json | head -1)
          if [ -z "$v" ]; then echo "could not parse version from frontend/package.json"; exit 1; fi
          echo "semver=$v" >> "$GITHUB_OUTPUT"
          echo "frontend version: $v"

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          # See build-backend.yml for why these flags are needed.
          config-inline: |
            [registry."192.168.0.2:1234"]
              http = true
              insecure = true

      - name: Configure registry credentials for buildx
        env:
          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
          REGISTRY_USER: ${{ github.actor }}
        run: |
          mkdir -p ~/.docker
          AUTH=$(printf '%s:%s' "$REGISTRY_USER" "$REGISTRY_TOKEN" | base64 -w0)
          cat > ~/.docker/config.json <<EOF
          {
            "auths": {
              "192.168.0.2:1234": {
                "auth": "$AUTH"
              }
            }
          }
          EOF

      - name: Compute tags
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: 192.168.0.2:1234/justin/provenance-frontend
          tags: |
            type=ref,event=branch,prefix=test-
            type=sha,prefix=test-sha-,format=long
            type=raw,value=${{ steps.ver.outputs.semver }}
            type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') }}
          labels: |
            org.opencontainers.image.source=https://git.jpaul.io/justin/provenance
            org.opencontainers.image.version=${{ steps.ver.outputs.semver }}

      - name: Build and push (amd64)
        uses: docker/build-push-action@v6
        with:
          context: ./frontend
          platforms: linux/amd64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

      - name: Link package to the provenance repo
        env:
          GITEA_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
        run: |
          code=$(curl -s -o /tmp/link.out -w "%{http_code}" -X POST \
            -H "Authorization: token ${GITEA_TOKEN}" \
            "https://git.jpaul.io/api/v1/packages/justin/container/provenance-frontend/-/link/provenance")
          echo "link -> provenance: HTTP $code"
          case "$code" in
            201) echo "OK — newly linked" ;;
            400|409) echo "OK — already linked" ;;
            *) cat /tmp/link.out; exit 1 ;;
          esac