---
name: Build container image
on:
  push:
    branches:
      - main
      - testing
  pull_request:
    branches:
      - main
      - testing
  #schedule:
  #  - cron: '05 10 * * *'  # 10:05am UTC everyday
  workflow_dispatch:

env:
  IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}"  # do not edit

concurrency:
  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
  cancel-in-progress: true

jobs:
  build_push:
    name: Build and push image
    runs-on: ubuntu-24.04

    permissions:
      contents: read
      packages: write
      id-token: write

    steps:
      # These stage versions are pinned by https://github.com/renovatebot/renovate
      - name: Show disk space
        run: sudo df -h

      - name: Maximize build space
        uses: ublue-os/remove-unwanted-software@695eb75bc387dbcd9685a8e72d23439d8686cba6
        with:
          extra-squeeze: true

      - name: Check if /mnt is there
        id: check-mnt
        run: |
          if sudo mountpoint /mnt; then
            echo "mnt_is_there=1" >> "$GITHUB_OUTPUT"
          else
            echo "mnt_is_there=0" >> "$GITHUB_OUTPUT"
          fi

      - name: Mount BTRFS for podman storage
        if: ${{ steps.check-mnt.outputs.mnt_is_there == '1' }}
        uses: ublue-os/container-storage-action@main
        with:
          target-dir: /var/lib/containers

      - name: Show available build space
        run: sudo df -h

      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7

      - name: Install just
        uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 #v4.0.0

      - name: Check Just Syntax
        shell: bash
        run: |
          just check

      - name: Image Name
        id: image-name
        run: |
          IMAGE_NAME=$(just image_name)

          echo "IMAGE_NAME=${IMAGE_NAME}" >> "$GITHUB_ENV"

      - name: Generate Version and Tags
        id: gen-version
        env:
          BASE_IMAGE: ${{ vars.BASE_IMAGE || 'ghcr.io/ublue-os/bazzite-deck:stable' }}
        run: |
          set -euo pipefail

          sudo podman pull "${BASE_IMAGE}"
          FEDORA_VERSION=$(sudo podman run --rm --entrypoint /usr/bin/rpm "${BASE_IMAGE}" -E %fedora)
          VERSION_BASE="${FEDORA_VERSION}.$(date -u +%Y%m%d)"

          if [[ "${GITHUB_REF_NAME}" == "testing" ]]; then
            VERSION_TAG="testing-${VERSION_BASE}"
            VERSION_PRETTY="Testing (F${VERSION_BASE})"
            IMAGE_BRANCH="testing"
            ALIAS_TAGS="${VERSION_TAG} testing testing-${FEDORA_VERSION}"
          else
            VERSION_TAG="${VERSION_BASE}"
            VERSION_PRETTY="Stable (F${VERSION_BASE})"
            IMAGE_BRANCH="stable"
            ALIAS_TAGS="${VERSION_TAG} stable-${VERSION_TAG} latest stable stable-${FEDORA_VERSION}"
          fi

          {
            echo "DEFAULT_TAG=${VERSION_TAG}"
            echo "IMAGE_BRANCH=${IMAGE_BRANCH}"
            echo "VERSION_TAG=${VERSION_TAG}"
            echo "VERSION_PRETTY=${VERSION_PRETTY}"
            echo "ALIAS_TAGS=${ALIAS_TAGS}"
          } >> "$GITHUB_ENV"

      - name: Prepare environment
        run: |
          # Lowercase the image uri https://github.com/macbre/push-to-ghcr/issues/12
          echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" >> "$GITHUB_ENV"
          echo "IMAGE_NAME=${IMAGE_NAME,,}" >> "$GITHUB_ENV"

      # This actually builds the container image
      - name: Build Image
        id: build-image
        env:
          BASE_IMAGE: ${{ vars.BASE_IMAGE || 'ghcr.io/ublue-os/bazzite-deck:stable' }}
          FLATPAK_REMOTE_URL: ${{ vars.FLATPAK_REMOTE_URL }}
          HOMEBREW_BOTTLE_DOMAIN: ${{ vars.HOMEBREW_BOTTLE_DOMAIN }}
          HOMEBREW_API_DOMAIN: ${{ vars.HOMEBREW_API_DOMAIN }}
          OSTREE_IMAGE_REF: ${{ vars.OSTREE_IMAGE_REF }}
          INSTRUMENTS_ENABLED: ${{ vars.INSTRUMENTS_ENABLED || 'true' }}
          INSTRUMENTS_RELEASE_REPOSITORY: ${{ vars.INSTRUMENTS_RELEASE_REPOSITORY || 'AeroCore-IO/booster-installer' }}
          INSTRUMENTS_VERSION: ${{ vars.INSTRUMENTS_VERSION || 'latest' }}
          INSTRUMENTS_RELEASE_API_BASE: ${{ vars.INSTRUMENTS_RELEASE_API_BASE || 'https://api.github.com' }}
        run: |
          sudo -E "$(command -v just)" build \
            "${IMAGE_NAME}" \
            "${DEFAULT_TAG}"

      # This is optional, this provides smaller delta updates
      - name: Rechunk with rpm-ostree
        id: rechunk
        run: |
          sudo -E "$(command -v just)" ostree-rechunk \
            "${IMAGE_NAME}" \
            "${DEFAULT_TAG}"

      # If you are feeling adventurous, use the new distro agnostic rechunker
      # https://github.com/coreos/chunkah
      # You can delete the Rechunk with rpm-ostree portion then if you use this
      #- name: Rechunk with Chunkah
      #  id: rechunk
      #  run: |
      #    sudo -E $(command -v just) rechunk \
      #      ${IMAGE_NAME} \
      #      ${DEFAULT_TAG}

      - name: Generate Build Tags
        id: gen-build-tags
        run: |
          echo "Tags for this Action..."
          echo "${ALIAS_TAGS}"
          echo "alias_tags=${ALIAS_TAGS}" >> "$GITHUB_OUTPUT"

      - name: Tag Image
        id: tag-images
        env:
          ALIAS_TAGS: ${{ steps.gen-build-tags.outputs.alias_tags }}
        run: |
          sudo -E "$(command -v just)" tag-images \
            "${IMAGE_NAME}" \
            "${DEFAULT_TAG}" \
            "${ALIAS_TAGS}"

      # These `if` statements keep pull requests from publishing packages.
      # They publish default-branch builds and manual testing branch builds.
      - name: Login to GitHub Container Registry
        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
        if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing')
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Push To GHCR
        if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing')
        id: push-image
        env:
          ALIAS_TAGS: ${{ steps.gen-build-tags.outputs.alias_tags }}
        run: |
          set -euox pipefail
          for tag in ${ALIAS_TAGS}; do
            sudo -E podman push --digestfile=/tmp/digestfile \
              "${IMAGE_NAME}:${tag}" "${IMAGE_REGISTRY}/${IMAGE_NAME}:${tag}"
          done

          digest=$(< /tmp/digestfile)

          echo "digest=${digest}" >> "$GITHUB_OUTPUT"

      # This section is optional and only needs to be enabled if you plan on distributing
      # your project for others to consume. You will need to create a public and private key
      # using Cosign and save the private key as a repository secret in Github for this workflow
      # to consume. For more details, review the image signing section of the README.
      - name: Install Cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
        if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing')
        # https://github.com/containers/container-libs/issues/388
        with:
          cosign-release: 'v2.6.3'

      - name: Sign container image
        id: sign-image
        if: github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || github.ref_name == 'testing')
        env:
          COSIGN_EXPERIMENTAL: false
          COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
          DIGEST: ${{ steps.push-image.outputs.digest }}
        run: |
          cosign sign -y --key env://COSIGN_PRIVATE_KEY "${IMAGE_REGISTRY}/${IMAGE_NAME}@${DIGEST}"