name: Build Hugo

on:
  push:
    branches: ["main"]

# Serialize blog publishes so builds cannot update its desired image at once.
# Other apps may still push to GitOps, so the push step also handles that race.
concurrency:
  group: blog-publish
  cancel-in-progress: false

env:
  REGISTRY: tea.ahmza.com
  IMAGE: tea.ahmza.com/ahmza/blog-ahmza-com

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write

    steps:
      - name: Checkout Repo
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4

      - name: Check GitOps update helper
        run: python3 -m unittest discover -s .gitea/tests -v

      - name: Login to Gitea Container Registry
        # Pin the v3 release ref so an upstream tag move cannot change CI code.
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ gitea.repository_owner }}
          password: ${{ secrets.GITEATOKEN }}

      # Hugo runs on BUILDPLATFORM; runtime stages only copy static files.
      # Both amd64 and arm64 images therefore build without QEMU emulation.
      - name: Set up Docker Buildx
        # v3, pinned to an immutable commit.
        # yamllint disable-line rule:line-length
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f

      - name: Build and push
        id: build
        # v6, pinned to an immutable commit.
        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8
        with:
          context: .
          platforms: linux/arm64,linux/amd64
          push: true
          tags: |
            ${{ env.IMAGE }}:latest
            ${{ env.IMAGE }}:${{ gitea.sha }}
          cache-from: type=registry,ref=${{ env.IMAGE }}:buildcache
          cache-to: type=registry,ref=${{ env.IMAGE }}:buildcache,mode=max

      - name: Check out cluster GitOps repository
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4
        with:
          repository: ahmza.com/k8s-starter-pack
          ref: main
          # This credential writes only GitOps, separately from registry access.
          token: ${{ secrets.GITOPS_TOKEN }}
          path: _gitops

      - name: Record the published image in Git
        env:
          BUILD_DIGEST: ${{ steps.build.outputs.digest }}
          SOURCE_SHA: ${{ gitea.sha }}
        run: |
          set -eu
          deploy_image="${IMAGE}@${BUILD_DIGEST}"
          python3 .gitea/scripts/update_gitops_image.py \
            _gitops/apps/blog-ahmza-com/deployment.yaml "$deploy_image"

          cd _gitops
          if git diff --quiet -- apps/blog-ahmza-com/deployment.yaml; then
            echo "GitOps already references $deploy_image"
            exit 0
          fi
          git config user.name "gitea-actions[bot]"
          git config user.email "gitea-actions[bot]@tea.ahmza.com"
          git add apps/blog-ahmza-com/deployment.yaml
          git commit -m "Deploy blog ${SOURCE_SHA}"

          # Rebase unrelated app updates; do not force-push or ignore conflicts.
          for attempt in 1 2 3; do
            if git push origin HEAD:main; then
              exit 0
            fi
            if [ "$attempt" -eq 3 ]; then
              echo "GitOps push failed after three attempts" >&2
              exit 1
            fi
            git pull --rebase origin main
          done