name: Build and Push agentchat Image

on:
  push:
    branches: [main]

jobs:
  quality:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.3.14
      - run: bun install --frozen-lockfile
      - name: Typecheck and test
        run: |
          bun run typecheck
          bun test

  build-image:
    needs: [quality]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Log in to container registry
        run: echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login git.gbrown.org -u "${{ secrets.REGISTRY_USER }}" --password-stdin
      # One build-and-push step, fully-qualified tags, --push from the builder.
      # This is the only form that works across all the runners: unqualified
      # names resolve to docker.io/library/* on podman-backed daemons, and
      # buildx docker-container drivers keep plain builds in the build cache
      # where a separate push step can't see them.
      - name: Build and push image
        run: docker build --push -f docker/Dockerfile -t git.gbrown.org/gib/agentchat:${{ gitea.sha }} -t git.gbrown.org/gib/agentchat:latest .

      # Watchtower was retired 2026-08-17: it recreated containers outside their
      # podman-compose pod, which took gitea down for three days while reporting
      # success. Deploys now SSH to the VPS and restart the systemd UNIT, so
      # podman-compose rebuilds the project properly (pod, networks, ports).
      #
      # The key is pinned to a forced command that accepts only a service name, so
      # it cannot open a shell or reach anything else. 192.168.2.2 is the VPS over
      # WireGuard: reachable from every runner, never the public internet.
      #
      # Non-fatal on purpose: the image is already pushed, and podman-update.timer
      # sweeps at midnight, so a trigger hiccup delays the deploy by hours rather
      # than failing a build that otherwise succeeded.
      - name: Trigger immediate deploy
        run: |
          echo "${{ secrets.DEPLOY_SSH_KEY }}" > "$HOME/.deploy_key"
          chmod 600 "$HOME/.deploy_key"
          ssh -i "$HOME/.deploy_key" \
              -o BatchMode=yes \
              -o StrictHostKeyChecking=accept-new \
              -o ConnectTimeout=15 \
              gib@192.168.2.2 agentchat \
            || echo "::warning::deploy trigger failed; nightly sweep will deploy instead"
          rm -f "$HOME/.deploy_key"