# Gitea Actions workflow. Uses the BlueBuild CLI directly — the blue-build/github-action
# is a GitHub-context composite and is not supported outside GitHub/GitLab CI.
# Runner requirement: act_runner must allow privileged job containers
# (container.privileged: true in the runner's config.yaml) — buildah needs it.
# NOTE: manual-only for now — no Actions runner is registered on the instance, and the
# image is currently built/pushed locally (see README "Building locally"). When a runner
# exists, restore the schedule + push triggers below to make builds fully automatic:
#   schedule:
#     - cron: "00 06 * * *"   # daily rebuild pulls in base-image updates
#   push:
#     branches: [main]
#     paths-ignore: ["**.md"]
name: bluebuild
on:
  workflow_dispatch:

jobs:
  bluebuild:
    name: Build Custom Image
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/blue-build/cli:v0.9
      options: --privileged
    env:
      # Auto-signs on push when this + cosign.pub (repo root) are present.
      COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
      # Gitea's auto job token cannot push packages (documented limitation),
      # so registry auth uses a PAT with write:package scope.
      BB_REGISTRY: git.lazypugs.com
      BB_REGISTRY_NAMESPACE: ckoch
      BB_USERNAME: ckoch
      BB_PASSWORD: ${{ secrets.REGISTRY_TOKEN }}
    steps:
      # Plain clone instead of actions/checkout: the CLI job container isn't
      # guaranteed to have node, and the repo is public.
      - name: Clone repo
        run: |
          git config --global --add safe.directory "$(pwd)"
          git clone --depth 1 --branch "${GITHUB_REF_NAME:-main}" "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git" .

      - name: Build and push signed image
        run: bluebuild build --verbose --push --retry-push recipes/recipe.yml