name: Build flutter-node image

# Triggers:
#   - push to main           → immediate rebuild (any change in the repo)
#   - weekly cron            → picks up upstream patch updates in
#                              cirruslabs/flutter:stable and node:20
#                              without a source change
#   - manual dispatch        → on-demand
on:
  push:
    branches: [main]
  schedule:
    # Sun 03:00 UTC. cirruslabs typically ships :stable bumps a few
    # hours after the upstream Flutter stable channel — adjust freely.
    - cron: "0 3 * * 0"
  workflow_dispatch:

jobs:
  build:
    # Skip the job entirely (no runner provisioning) when the registry
    # host isn't configured — shows as "skipped" in the UI rather than
    # burning minutes on a build that can't be pushed. Secrets can't be
    # referenced in job-level if:, so REGISTRY_TOKEN is still checked
    # in the first step below.
    if: vars.REGISTRY_HOST != ''
    runs-on: ubuntu-docker
    permissions:
      packages: write
    steps:
      - name: Validate registry token
        run: |
          if [ -z "${{ secrets.REGISTRY_TOKEN }}" ]; then
            echo "::error::Missing required config: secrets.REGISTRY_TOKEN"
            exit 1
          fi

      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Buildx
        uses: docker/setup-buildx-action@v3

      - name: Compute date tag
        id: date
        run: echo "date=$(date -u +%Y%m%d)" >> "$GITHUB_OUTPUT"

      # Same registry + PAT pattern other projects on this Gitea
      # instance use. The auto-injected gitea token is rejected by the
      # registry path, hence the manually-issued PAT in REGISTRY_TOKEN.
      - name: Log in to Gitea registry
        uses: docker/login-action@v3
        with:
          registry: ${{ vars.REGISTRY_HOST }}
          username: ${{ gitea.actor }}
          password: ${{ secrets.REGISTRY_TOKEN }}

      - name: Build and push
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          # Two tags:
          #   :stable     — moving, what runners pull by default
          #   :YYYYMMDD   — immutable, for pinning / rollback
          tags: |
            ${{ vars.REGISTRY_HOST }}/ci-images/flutter-node:stable
            ${{ vars.REGISTRY_HOST }}/ci-images/flutter-node:${{ steps.date.outputs.date }}
          build-args: |
            IMAGE_SOURCE=https://${{ vars.REGISTRY_HOST }}/ci-images/flutter-node
          cache-from: type=registry,ref=${{ vars.REGISTRY_HOST }}/ci-images/flutter-node:stable
          cache-to: type=inline