name: Container

'on':
  workflow_dispatch:
  push:
    branches:
      - main

permissions:
  contents: read

concurrency:
  group: container-${{ gitea.workflow }}-${{ gitea.ref }}
  cancel-in-progress: true

env:
  REGISTRY: git.sechmachine.io.vn
  IMAGE_NAME: sechmachine/labtimesheet

jobs:
  verify:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    env:
      TESTCONTAINERS_HOST_OVERRIDE: host.docker.internal
    steps:
      - name: Check out source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Set up Java 25
        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
        with:
          distribution: temurin
          java-version: '25'
          cache: maven

      - name: Set up Node 24
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '24'
          cache: npm

      - name: Verify Docker for PostgreSQL tests
        run: docker info

      - name: Install frontend dependencies
        run: npm ci

      - name: Run frontend tests
        run: npm run test:ui

      - name: Build frontend assets
        run: npm run build

      - name: Verify generated assets are committed
        run: git diff --exit-code -- src/main/resources/static/assets/app.css src/main/resources/static/assets/icons.svg

      - name: Run Maven tests
        run: ./mvnw -B test

      - name: Verify Javadoc
        run: ./mvnw -B -DskipTests -Ddoclint=all javadoc:javadoc

      - name: Verify whitespace
        run: git diff --check

  amd64:
    needs: verify
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      contents: read
      packages: write
    steps:
      - name: Check out source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Set up Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

      - name: Select image tags
        id: image
        env:
          EVENT_NAME: ${{ gitea.event_name }}
          GITEA_REF: ${{ gitea.ref }}
          GITEA_SHA: ${{ gitea.sha }}
        run: |
          publish=false
          image="$REGISTRY/$IMAGE_NAME"
          if [ "$EVENT_NAME" = "push" ] && [ "$GITEA_REF" = "refs/heads/main" ]; then
            publish=true
          fi
          {
            echo "publish=$publish"
            echo "image=$image"
            echo "tags<<EOF"
            echo "$image:sha-${GITEA_SHA}-amd64"
            if [ "$publish" = "true" ]; then
              echo "$image:sha-${GITEA_SHA}"
              echo "$image:main"
            fi
            echo "EOF"
          } >> "$GITHUB_OUTPUT"

      - name: Log in to registry
        if: steps.image.outputs.publish == 'true'
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ gitea.actor }}
          password: ${{ secrets.REGISTRY_TOKEN }}

      - name: Build AMD64 image and publish main
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          platforms: linux/amd64
          push: ${{ steps.image.outputs.publish }}
          tags: ${{ steps.image.outputs.tags }}
          build-args: |
            VCS_REF=${{ gitea.sha }}

  arm64:
    # Gitea cannot schedule a probe on a missing label. Enable this repository variable only
    # while a trusted ubuntu-latest-arm runner is registered and online.
    if: vars.ARM64_RUNNER_AVAILABLE == 'true'
    needs: verify
    runs-on: ubuntu-latest-arm
    timeout-minutes: 30
    permissions:
      contents: read
      packages: write
    steps:
      - name: Check out source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Set up Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

      - name: Select image tag
        id: image
        env:
          EVENT_NAME: ${{ gitea.event_name }}
          GITEA_REF: ${{ gitea.ref }}
          GITEA_SHA: ${{ gitea.sha }}
        run: |
          publish=false
          image="$REGISTRY/$IMAGE_NAME"
          if [ "$EVENT_NAME" = "push" ] && [ "$GITEA_REF" = "refs/heads/main" ]; then
            publish=true
          fi
          echo "publish=$publish" >> "$GITHUB_OUTPUT"
          echo "tag=$image:sha-${GITEA_SHA}-arm64" >> "$GITHUB_OUTPUT"

      - name: Log in to registry
        if: steps.image.outputs.publish == 'true'
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ gitea.actor }}
          password: ${{ secrets.REGISTRY_TOKEN }}

      - name: Build native ARM64 image
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          platforms: linux/arm64
          push: ${{ steps.image.outputs.publish }}
          tags: ${{ steps.image.outputs.tag }}
          build-args: |
            VCS_REF=${{ gitea.sha }}

  manifest:
    if: gitea.event_name == 'push' && gitea.ref == 'refs/heads/main' && vars.ARM64_RUNNER_AVAILABLE == 'true'
    needs: [amd64, arm64]
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
      packages: write
    steps:
      - name: Set up Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

      - name: Log in to registry
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ gitea.actor }}
          password: ${{ secrets.REGISTRY_TOKEN }}

      - name: Publish combined manifest
        env:
          IMAGE: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          GITEA_SHA: ${{ gitea.sha }}
        run: |
          docker buildx imagetools create \
            --tag "$IMAGE:sha-${GITEA_SHA}" \
            --tag "$IMAGE:main" \
            "$IMAGE:sha-${GITEA_SHA}-amd64" \
            "$IMAGE:sha-${GITEA_SHA}-arm64"