# CI for the Coffey Labs build of Mastodon: upstream Mastodon plus the
# coffeylabs theme (COFFEYLABS.md). Upstream's own .github/workflows were
# removed in this fork; this is the only workflow, and it runs on Gitea only.
#
# Every change builds the image without pushing it, to prove the theme still
# compiles against the upstream it sits on. Releases are cut by pushing a tag
# named v<upstream>-coffeylabs.<n>, e.g. v4.7.3-coffeylabs.1, where <upstream>
# is the version in lib/mastodon/version.rb. The tag must name the commit's
# own upstream version and be on main, or nothing is published.
#
# Every job runs in an image pinned by digest (tag in the trailing comment),
# and the only action used is coffey-labs/actions/checkout pinned by SHA.
# Read the comment for the version; the digest is what runs.
name: ci

on:
  push:
    branches: [main]
    tags: ['v*-coffeylabs.*']
  pull_request:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  # ------------------------------------------------------------- build ------
  # The full production image, as the Dockerfile builds it: Ruby gems, the
  # Vite asset build with both themes, libvips and ffmpeg. Nothing is pushed.
  docker-build:
    if: ${{ !startsWith(github.ref, 'refs/tags/') }}
    runs-on: docker
    timeout-minutes: 90
    container:
      image: docker:28-cli@sha256:625d9431a9f54c5a2bc90f24f0e1c3d55b1349fd857dd85035f98c2c9acbdd4d # 28-cli
      volumes:
        - /var/run/docker.sock:/var/run/docker.sock
    steps:
      - uses: coffey-labs/actions/checkout@fab0c4d45e0162963965f1555df27b7bed5e20ec
      - run: |
          tag="mastodon:ci-$(echo "$GITHUB_SHA" | cut -c1-8)"
          docker build --build-arg MASTODON_VERSION_METADATA=coffeylabs.ci -t "$tag" .
          docker run --rm --entrypoint sh "$tag" -c \
            'ls public/packs/assets/themes/ | grep -q "^coffeylabs-.*\.css$"' \
            || { echo "!! the image has no compiled coffeylabs theme" >&2; exit 1; }
          docker image rm "$tag"

  # ----------------------------------------------------------- release ------
  # linux/amd64 only: the one server that runs it is amd64. The streaming
  # server is unchanged by the theme, so it keeps using upstream's image at
  # the same version. PACKAGE_TOKEN (jcoffey-dev, write:package) logs in: the
  # job's own token is refused by the container registry. The release is
  # created last, so a release on the page always has its image behind it.
  publish:
    if: ${{ startsWith(github.ref, 'refs/tags/v') }}
    runs-on: docker
    timeout-minutes: 90
    container:
      image: docker:28-cli@sha256:625d9431a9f54c5a2bc90f24f0e1c3d55b1349fd857dd85035f98c2c9acbdd4d # 28-cli
      volumes:
        - /var/run/docker.sock:/var/run/docker.sock
    env:
      REGISTRY: ${{ vars.REGISTRY }}
      IMAGE: ${{ vars.REGISTRY }}/${{ github.repository }}
      TAG: ${{ github.ref_name }}
      PACKAGE_TOKEN: ${{ secrets.PACKAGE_TOKEN }}
      # The forge's public address, for the "View source code" link. Not
      # GITHUB_SERVER_URL: on this runner that is Gitea's internal address,
      # which no visitor can reach.
      PUBLIC_URL: https://git.coffeylabs.org
    steps:
      - uses: coffey-labs/actions/checkout@fab0c4d45e0162963965f1555df27b7bed5e20ec
        with:
          fetch-depth: 0
      - id: v
        run: |
          set -eu
          upstream="$(awk '/def (major|minor|patch)$/ { getline; gsub(/ /, ""); printf "%s%s", sep, $0; sep="." }' lib/mastodon/version.rb)"
          case "$TAG" in
            "v$upstream-coffeylabs."[0-9]*) ;;
            *) echo "!! $TAG does not name this commit's upstream version; expected v$upstream-coffeylabs.<n>" >&2; exit 1 ;;
          esac
          git merge-base --is-ancestor "$(git rev-parse "${TAG}^{commit}")" origin/main \
            || { echo "!! $TAG is not on main" >&2; exit 1; }
          echo "METADATA=${TAG#v"$upstream"-}" >> "$GITHUB_OUTPUT"
      - run: |
          test -n "$REGISTRY"
          test -n "$PACKAGE_TOKEN" || { echo "PACKAGE_TOKEN secret is not set on this repository" >&2; exit 1; }
          echo "$PACKAGE_TOKEN" | docker login -u jcoffey-dev --password-stdin "$REGISTRY"
      - env:
          METADATA: ${{ steps.v.outputs.METADATA }}
        run: |
          docker build \
            --build-arg MASTODON_VERSION_METADATA="$METADATA" \
            --build-arg SOURCE_COMMIT="$GITHUB_SHA" \
            --build-arg SOURCE_BASE_URL="$PUBLIC_URL/$GITHUB_REPOSITORY" \
            --build-arg SOURCE_TAG="$TAG" \
            --tag "$IMAGE:$TAG" .
          docker push "$IMAGE:$TAG"
          docker image rm "$IMAGE:$TAG"
      # Show the package on the repository's Packages tab. Idempotent.
      - run: |
          apk add --no-cache -q curl
          curl -fsS -o /dev/null -X POST -H "Authorization: token $PACKAGE_TOKEN" \
            "$CI_SERVER_INTERNAL/api/v1/packages/${GITHUB_REPOSITORY%%/*}/container/${GITHUB_REPOSITORY#*/}/-/link/${GITHUB_REPOSITORY#*/}" \
            || echo "package already linked (or link refused); not fatal"
      - env:
          TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -eu
          body="Mastodon ${TAG%-coffeylabs.*} with the coffeylabs theme.\n\nImage: \`$IMAGE:$TAG\` (linux/amd64). Use upstream's mastodon-streaming image at ${TAG%-coffeylabs.*}."
          curl -fsS -o /dev/null -H "Authorization: token $TOKEN" -H "Content-Type: application/json" \
            --data "{\"tag_name\":\"$TAG\",\"name\":\"$TAG\",\"body\":\"$body\"}" \
            "$CI_SERVER_INTERNAL/api/v1/repos/$GITHUB_REPOSITORY/releases"
          echo "release $TAG created"
      - if: always()
        run: docker logout "$REGISTRY" || true