name: build-and-deploy

# Build the image, push to Harbor, bump the deploy tag, push back → ArgoCD deploys.
# paths-ignore avoids an infinite loop: the tag-bump commit only touches deploy/.
on:
  push:
    branches: [main]
    paths-ignore:
      - "deploy/**"
      - "**.md"

env:
  IMAGE: harbor.devroadmap.ru/homelab/devroadmap-demo

jobs:
  build-deploy:
    runs-on: k8s-arm64          # act_runner label → docker:27-cli, DinD at localhost:2375
    env:
      DOCKER_HOST: tcp://localhost:2375
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Short SHA
        id: sha
        run: echo "value=${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT"

      - name: Login to Harbor
        run: |
          echo "${{ secrets.HARBOR_ROBOT_PASSWORD }}" \
            | docker login harbor.devroadmap.ru -u "${{ secrets.HARBOR_ROBOT_USER }}" --password-stdin

      - name: Build and push (native arm64)
        run: |
          docker build \
            --build-arg GIT_SHA="${{ steps.sha.outputs.value }}" \
            --build-arg BUILD_DATE="$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
            -t "$IMAGE:${{ steps.sha.outputs.value }}" \
            -t "$IMAGE:latest" .
          docker push "$IMAGE:${{ steps.sha.outputs.value }}"
          docker push "$IMAGE:latest"

      - name: Bump deploy tag (GitOps) and push back
        run: |
          sed -i "s#newTag:.*#newTag: \"${{ steps.sha.outputs.value }}\"#" deploy/kustomization.yaml
          git config user.name "forgejo-ci"
          git config user.email "ci@git.devroadmap.ru"
          git add deploy/kustomization.yaml
          git commit -m "ci: deploy ${{ steps.sha.outputs.value }} [skip ci]" || { echo "no change"; exit 0; }
          git push "http://ci:${{ secrets.FORGEJO_TOKEN }}@forgejo.forgejo.svc/${{ github.repository }}.git" HEAD:main

      - name: Summary
        run: |
          echo "Built $IMAGE:${{ steps.sha.outputs.value }} → Harbor; deploy/ bumped → ArgoCD will sync." >> "$GITHUB_STEP_SUMMARY"