name: build

on:
  push:
    branches: [master]
    tags: ['v*']
  workflow_dispatch:

env:
  REGISTRY: harbor.pmagnus.cloud
  IMAGE: harbor.pmagnus.cloud/btcdata/btcdata

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Unit and PostgreSQL fencing tests
        run: bash scripts/test-fencing.sh

      - name: Generate immutable tags
        id: tags
        shell: bash
        run: |
          set -euo pipefail
          SHA=$(git rev-parse --short HEAD)
          case "$GITHUB_REF" in
            refs/tags/v*) VERSION="${GITHUB_REF_NAME#v}" ;;
            *) VERSION="main-$(date -u +%Y%m%d%H%M%S)" ;;
          esac
          echo "primary=$IMAGE:$VERSION" >> "$GITHUB_OUTPUT"
          echo "qualified=$IMAGE:$VERSION-$SHA" >> "$GITHUB_OUTPUT"

      # anvil is not a NetBird peer. Keep BuildKit on the runner host network
      # until anvil can resolve and reach Harbor directly from job networks.
      - uses: docker/setup-buildx-action@v3
        with:
          driver-opts: network=host

      - uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ secrets.HARBOR_ROBOT_USER }}
          password: ${{ secrets.HARBOR_ROBOT_TOKEN }}

      - uses: docker/build-push-action@v6
        with:
          context: .
          platforms: linux/amd64
          push: true
          tags: ${{ steps.tags.outputs.primary }}
          cache-from: type=registry,ref=${{ env.IMAGE }}:buildcache
          cache-to: type=registry,ref=${{ env.IMAGE }}:buildcache,mode=max

      - name: Wait for Harbor policy, then add SHA tag
        env:
          PRIMARY: ${{ steps.tags.outputs.primary }}
          QUALIFIED: ${{ steps.tags.outputs.qualified }}
        run: |
          for attempt in $(seq 1 60); do
            if docker buildx imagetools inspect "$PRIMARY" >/dev/null 2>&1; then
              docker buildx imagetools create --tag "$QUALIFIED" "$PRIMARY"
              exit 0
            fi
            echo "waiting for Harbor scan/pull policy ($attempt/60)"
            sleep 10
          done
          echo "Harbor did not approve $PRIMARY within 10 minutes" >&2
          exit 1

      - name: Summary
        run: echo "pushed ${{ steps.tags.outputs.primary }} and ${{ steps.tags.outputs.qualified }}"