name: "⚒️ Publish Worker"

on:
  workflow_call:
    inputs:
      image_tag:
        description: The image tag to publish
        type: string
        required: false
        default: ""
      image_registry:
        description: The registry namespace to publish under (e.g. ghcr.io/<owner>)
        type: string
        required: false
        default: ""
    secrets:
      DOCKERHUB_USERNAME:
        required: false
      DOCKERHUB_TOKEN:
        required: false
  push:
    tags:
      - "infra-dev-*"
      - "infra-test-*"
      - "infra-prod-*"

permissions:
  packages: write
  contents: read

jobs:
  build:
    strategy:
      matrix:
        package: [coordinator, docker-provider, kubernetes-provider]
    runs-on: ubuntu-latest
    env:
      DOCKER_BUILDKIT: "1"
      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
    steps:
      - name: ⬇️ Checkout git repo
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: 📦 Get image repo
        id: get_repository
        env:
          PACKAGE: ${{ matrix.package }}
        run: |
          if [[ "$PACKAGE" == *-provider ]]; then
            repo="provider/${PACKAGE%-provider}"
          else
            repo="$PACKAGE"
          fi
          echo "repo=${repo}" >> "$GITHUB_OUTPUT"

      - id: get_tag
        uses: ./.github/actions/get-image-tag
        with:
          tag: ${{ inputs.image_tag }}

      - name: 🐋 Set up Docker Buildx
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0

      # ..to avoid rate limits when pulling images
      - name: 🐳 Login to DockerHub
        if: ${{ env.DOCKERHUB_USERNAME }}
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: 🚢 Build Container Image
        run: |
          docker build -t infra_image -f ./apps/${{ matrix.package }}/Containerfile .

      # ..to push image
      - name: 🐙 Login to GitHub Container Registry
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: 🐙 Push to GitHub Container Registry
        run: |
          docker tag infra_image "$REGISTRY/$REPOSITORY:$IMAGE_TAG"
          docker push "$REGISTRY/$REPOSITORY:$IMAGE_TAG"
        env:
          # Resolved by the caller when invoked from publish.yml; falls back to the
          # IMAGE_REGISTRY repository variable (or ghcr.io/<owner>) for the direct
          # push triggers above, so a fork publishes to its own namespace.
          REGISTRY: ${{ inputs.image_registry || vars.IMAGE_REGISTRY || format('ghcr.io/{0}', github.repository_owner) }}
          REPOSITORY: ${{ steps.get_repository.outputs.repo }}
          IMAGE_TAG: ${{ steps.get_tag.outputs.tag }}

      # - name: 🐙 Push 'v3' tag to GitHub Container Registry
      #   if: steps.get_tag.outputs.is_semver == 'true'
      #   run: |
      #     docker tag infra_image "$REGISTRY/$REPOSITORY:v3"
      #     docker push "$REGISTRY/$REPOSITORY:v3"
      #   env:
      #     REGISTRY: ghcr.io/triggerdotdev
      #     REPOSITORY: ${{ steps.get_repository.outputs.repo }}