name: Build image when workload image tag changes

on:
  push:
    # Uncomment/adjust once it's working:
    # branches: [ main ]
    paths:
      - "argocd/deployment.yaml"
      - "Dockerfile"

jobs:
  build-if-image-changed:
    runs-on: self-hosted   # or whatever label your runner uses

    env:
      DEPLOY_FILE: "argocd/deployment.yaml"
      CONTAINER_NAME: "web"                       # we only consider this container
      EXPECTED_REPO: "git.baumann.gr/adebaumann/vui"  # sanity-check the repo

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 2

      - name: Determine base commit
        id: base
        shell: bash
        run: |
          set -euo pipefail
          if git rev-parse --verify -q HEAD~1 >/dev/null; then
            echo "base=$(git rev-parse HEAD~1)" >> "$GITHUB_OUTPUT"
          else
            echo "base=$(git hash-object -t tree /dev/null)" >> "$GITHUB_OUTPUT"
          fi

      - name: Install yq
        shell: bash
        run: |
          set -euo pipefail
          YQ_VER=v4.44.3
          curl -sL "https://github.com/mikefarah/yq/releases/download/${YQ_VER}/yq_linux_amd64" -o /usr/local/bin/yq
          chmod +x /usr/local/bin/yq
          yq --version

      - name: Read workload image from deployment (old vs new)
        id: img
        shell: bash
        run: |
          set -euo pipefail
          file="$DEPLOY_FILE"
          cname="$CONTAINER_NAME"
          expected_repo="$EXPECTED_REPO"

          # Extract ONLY from .spec.template.spec.containers[], selecting by .name == cname
          # Works across multi-doc YAML (the Service doc will be ignored)
          extract() {
            yq -r '
              select(.kind == "Deployment") |
              .spec.template.spec.containers // [] |
              map(select(.name == env(cname))) |
              .[]?.image
            ' "$1" 2>/dev/null | tail -n 1
          }

          debug_list() {
            echo "== workload images in $1 ==" >&2
            yq -r '
              select(.kind == "Deployment") |
              .spec.template.spec.containers // [] |
              .[] | "\(.name): \(.image)"
            ' "$1" 2>/dev/null | nl -ba >&2 || true
          }

          # Old image (from previous commit)
          if git cat-file -e "${{ steps.base.outputs.base }}":"$file" 2>/dev/null; then
            git show "${{ steps.base.outputs.base }}:$file" > /tmp/old.yaml
            debug_list /tmp/old.yaml
            old_image="$(extract /tmp/old.yaml || true)"
          else
            old_image=""
          fi

          # New image (from workspace)
          if [ -f "$file" ]; then
            debug_list "$file"
            new_image="$(extract "$file" || true)"
          else
            new_image=""
          fi

          echo "Old workload image: $old_image"
          echo "New workload image: $new_image"

          if [ -z "$new_image" ]; then
            echo "ERROR: Could not find containers[].name == \"$cname\" in $file"
            exit 1
          fi

          # Sanity-check repo prefix (avoid accidentally building the init image)
          new_repo="${new_image%:*}"
          new_tag="${new_image##*:}"
          if [[ "$new_repo" != "$expected_repo" ]]; then
            echo "ERROR: Found container \"$cname\" image repo is \"$new_repo\" but expected \"$expected_repo\""
            exit 1
          fi

          # Old tag (if any)
          if [ -n "$old_image" ]; then
            old_tag="${old_image##*:}"
          else
            old_tag=""
          fi

          registry="$(echo "$new_repo" | awk -F/ '{print $1}')"

          {
            echo "changed=$([ "$old_tag" != "$new_tag" ] && echo true || echo false)"
            echo "new_image=$new_image"
            echo "new_repo=$new_repo"
            echo "new_tag=$new_tag"
            echo "registry=$registry"
          } >> "$GITHUB_OUTPUT"

      - name: Skip if tag unchanged
        if: steps.img.outputs.changed != 'true'
        run: echo "Workload image tag unchanged; skipping build."

      - name: Set up Buildx
        if: steps.img.outputs.changed == 'true'
        uses: docker/setup-buildx-action@v3

      - name: Log in to registry
        if: steps.img.outputs.changed == 'true'
        uses: docker/login-action@v3
        with:
          registry: ${{ steps.img.outputs.registry }}
          username: ${{ secrets.REGISTRY_USER }}
          password: ${{ secrets.REGISTRY_PASSWORD }}

      - name: Build and push (exact tag from deployment)
        if: steps.img.outputs.changed == 'true'
        uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: |
            ${{ steps.img.outputs.new_image }}
            ${{ steps.img.outputs.new_repo }}:latest
          labels: |
            org.opencontainers.image.source=${{ gitea.repository }}
            org.opencontainers.image.revision=${{ gitea.sha }}
          cache-from: type=gha
          cache-to: type=gha,mode=max