name: Build and Push Containers

on:
  push:
    branches:
      - main
  release:
    types:
      - published

jobs:
  # Gate: the image is only published if the suite is green. A failing job here
  # leaves :main on the last good build, which is what `podman auto-update`
  # keeps serving on reeseapps-mirror — so red means "nothing shipped", not
  # "production is broken".
  test:
    runs-on: ubuntu-latest
    container:
      image: python:3.13-slim
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install the package and the test tooling
        run: |
          pip install --no-cache-dir --upgrade pip
          pip install --no-cache-dir -e .
          pip install --no-cache-dir \
            pytest pytest-asyncio pytest-cov pytest-timeout httpx ruff

      - name: Lint
        run: |
          ruff check .
          ruff format --check .

      # Unit + API only. tests/e2e drives a real Chromium through capture ->
      # encode -> SRTP -> decode and needs a browser install and, for the
      # realdisplay rung, an X server; both stay local gates (see AGENTS.md).
      # --ignore keeps them out of collection entirely: -m filtering happens
      # after import, and tests/e2e/conftest.py imports playwright.
      - name: Test
        run: pytest -q --no-cov --ignore=tests/e2e

      - name: Smoke the image build
        # Catches a broken Containerfile (a missing COPY source, a bad uv
        # install) here rather than in the publish job below.
        run: |
          apt-get update -qq && apt-get install -y -qq --no-install-recommends podman
          podman build -t mirror:ci .
          podman run --rm mirror:ci --help >/dev/null

  build-and-push-app:
    needs: test
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Login to Gitea Container Registry
        uses: docker/login-action@v3
        with:
          registry: gitea.reeseapps.com
          username: ${{ secrets.REGISTRY_USERNAME }}
          password: ${{ secrets.REGISTRY_PASSWORD }}

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: gitea.reeseapps.com/experimental/mirror
          tags: |
            type=raw,value=main,enable=${{ github.ref == 'refs/heads/main' }}
            type=ref,event=tag

      - name: Build and push app image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: Containerfile
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}