name: Build and Push Next App

on:
  push:
    branches:
      - main
    paths:
      - 'apps/next/**'
      - 'packages/**'
      - 'tools/**'
      - 'scripts/**'
      - 'docker/**'
      - '.gitea/workflows/build-next.yml'
      - 'package.json'
      - 'bun.lock'
      - 'turbo.json'

# One image build at a time; a newer push waits rather than racing.
concurrency:
  group: build-next
  cancel-in-progress: false

# This template is not deployed. CI runs the quality gate and builds and pushes
# the image so the template stays known-good. Env comes from the Infisical
# `staging` environment: each job logs in as the read-only
# `convexmonorepo-base-ci` machine identity and writes it to a temp file
# (scripts/ci-export-env.mjs), so no values live in Gitea.
jobs:
  # Quality gate: workspace lint (sherif), eslint, typecheck and the unit,
  # integration and component suites must pass before anything touches
  # production. The local-stack e2e smoke check is skipped in CI.
  quality:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        # Plain git instead of actions/checkout: rootless podman on cirunner-vps
        # rejects symlinks inside cached actions ("path escapes from parent").
        env:
          GITEA_TOKEN: ${{ gitea.token }}
        run: |
          git init -q .
          git remote add origin "${{ gitea.server_url }}/${{ gitea.repository }}.git"
          auth="$(printf 'x-access-token:%s' "$GITEA_TOKEN" | base64 -w0)"
          git -c http.extraHeader="Authorization: basic $auth" \
            fetch -q --depth 1 origin "${{ gitea.sha }}"
          git checkout -q FETCH_HEAD

      - name: Set up Bun
        # Install script instead of oven-sh/setup-bun (same podman symlink issue).
        run: |
          curl -fsSL https://bun.sh/install | bash -s "bun-v1.3.14" >/dev/null
          echo "$HOME/.bun/bin" >> "$GITHUB_PATH"

      - name: Install dependencies
        run: ./scripts/ci-install

      - name: Lint and typecheck
        env:
          INFISICAL_CLIENT_ID: ${{ secrets.INFISICAL_CLIENT_ID }}
          INFISICAL_CLIENT_SECRET: ${{ secrets.INFISICAL_CLIENT_SECRET }}
        run: |
          env_file="$(mktemp)"
          trap 'rm -f "$env_file"' EXIT
          node scripts/ci-export-env.mjs staging > "$env_file"
          bunx dotenv -e "$env_file" -- env NODE_ENV=test SKIP_E2E=1 bun run ci:check

  build-next:
    needs: [quality]
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        # Plain git instead of actions/checkout: rootless podman on cirunner-vps
        # rejects symlinks inside cached actions ("path escapes from parent").
        env:
          GITEA_TOKEN: ${{ gitea.token }}
        run: |
          git init -q .
          git remote add origin "${{ gitea.server_url }}/${{ gitea.repository }}.git"
          auth="$(printf 'x-access-token:%s' "$GITEA_TOKEN" | base64 -w0)"
          git -c http.extraHeader="Authorization: basic $auth" \
            fetch -q --depth 1 origin "${{ gitea.sha }}"
          git checkout -q FETCH_HEAD

      - name: Log in to container registry
        run: |
          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login git.gbrown.org -u "${{ secrets.REGISTRY_USER }}" --password-stdin

      - name: Build app using project script
        env:
          INFISICAL_CLIENT_ID: ${{ secrets.INFISICAL_CLIENT_ID }}
          INFISICAL_CLIENT_SECRET: ${{ secrets.INFISICAL_CLIENT_SECRET }}
        run: |
          env_file="$(mktemp)"
          trap 'rm -f "$env_file"' EXIT
          node scripts/ci-export-env.mjs staging > "$env_file"
          CI_ENV_FILE="$env_file" ./scripts/build-next-app staging

      - name: Tag built image
        run: |
          docker tag convexmonorepo-no-payload-next:latest git.gbrown.org/gib/convexmonorepo-no-payload-next:${{ gitea.sha }}
          docker tag convexmonorepo-no-payload-next:latest git.gbrown.org/gib/convexmonorepo-no-payload-next:latest

      - name: Push image tags
        run: |
          docker push git.gbrown.org/gib/convexmonorepo-no-payload-next:${{ gitea.sha }}
          docker push git.gbrown.org/gib/convexmonorepo-no-payload-next:latest