pansy/.gitea/workflows/build-image.yml

name: Build image

# Build the single-binary image and push it to the Gitea container registry so
# it can be deployed with Komodo. Tagging (see README for the canonical table):
#   * main            -> :latest
#   * any other branch -> :<branch-name>   (sanitized to valid Docker tag chars)
#   * every build also -> :sha-<short>      (immutable, handy for pinning)
#
# Runs on every branch push (so branch images are always available) and can be
# triggered manually. A push to a PR branch covers the PR too, so there is no
# separate pull_request trigger (avoids double builds).
#
# On main (or a manual dispatch) a successful build also points the Komodo `pansy`
# stack at the fresh :sha-<short> image (PANSY_TAG) and redeploys it — mirroring
# mort's pipeline. Branch builds only push the image; they never deploy.

on:
  push:
    branches: ['**']
  workflow_dispatch:

concurrency:
  group: build-image-${{ github.ref }}
  cancel-in-progress: true

env:
  IMAGE_NAME: gitea.stevedudenhoeffer.com/steve/pansy

jobs:
  build-and-push:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        # Untrusted values (branch name) go through env, never inline ${{ }}, so a
        # crafted branch name can't inject shell. Check out the exact triggering
        # commit so the sha-<short> tag matches the code that was built.
        env:
          REPO: ${{ github.repository }}
          REF_NAME: ${{ github.ref_name }}
          SHA: ${{ github.sha }}
          GIT_TOKEN: ${{ github.token }}
        run: |
          git init -q .
          git remote add origin "https://token:${GIT_TOKEN}@gitea.stevedudenhoeffer.com/${REPO}.git"
          git fetch -q --depth=1 origin "$SHA" || git fetch -q --depth=1 origin "$REF_NAME"
          git checkout -q FETCH_HEAD

      - name: Set up Docker Buildx
        # Check first so a genuine create failure surfaces (rather than being
        # hidden behind a swallowed "already exists").
        run: |
          docker buildx inspect pansy-builder >/dev/null 2>&1 \
            || docker buildx create --name pansy-builder --driver docker-container
          docker buildx use pansy-builder

      - name: Log in to Gitea registry
        env:
          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
        run: echo "${REGISTRY_PASSWORD}" | docker login gitea.stevedudenhoeffer.com -u "${REGISTRY_USER}" --password-stdin

      - name: Build and push (linux/amd64)
        env:
          REF_NAME: ${{ github.ref_name }}
          SHA: ${{ github.sha }}
        run: |
          SHA_SHORT=$(echo "$SHA" | cut -c1-7)

          if [ "$REF_NAME" = "main" ]; then
            PRIMARY="latest"
          else
            # Normalize the branch name to valid Docker tag chars [a-zA-Z0-9._-].
            PRIMARY=$(echo "$REF_NAME" | sed 's/[^a-zA-Z0-9._-]/-/g; s/--*/-/g; s/^[-.]*//; s/-*$//')
            # A non-main branch must never clobber :latest, and the tag can't be empty.
            [ "$PRIMARY" = "latest" ] && PRIMARY="branch-latest"
            [ -z "$PRIMARY" ] && PRIMARY="branch-${SHA_SHORT}"
          fi

          # Build the tag flags as an array so no word-splitting/quoting surprises.
          TAGS=(--tag "${IMAGE_NAME}:${PRIMARY}" --tag "${IMAGE_NAME}:sha-${SHA_SHORT}")
          echo "Building ${IMAGE_NAME}:${PRIMARY} and ${IMAGE_NAME}:sha-${SHA_SHORT}"

          docker buildx build \
            --push \
            --platform linux/amd64 \
            "${TAGS[@]}" \
            --build-arg "BUILD_COMMIT=${SHA}" \
            --build-arg "BUILD_BRANCH=${REF_NAME}" \
            --build-arg "BUILD_TIME=$(date -u '+%Y-%m-%dT%H:%M:%SZ')" \
            --file ./Dockerfile \
            .

      - name: Point Komodo at the fresh image (PANSY_TAG)
        # Only deploy from main or a manual dispatch, and only if the build above
        # succeeded. Secrets travel through env (never inline ${{ }}); the tag is
        # sha-<7hex>, safe for the sed replacement below.
        if: (github.ref_name == 'main' || github.event_name == 'workflow_dispatch') && success()
        env:
          SHA: ${{ github.sha }}
          KOMODO_URL: ${{ secrets.KOMODO_URL }}
          KOMODO_API_KEY: ${{ secrets.KOMODO_API_KEY }}
          KOMODO_API_SECRET: ${{ secrets.KOMODO_API_SECRET }}
        run: |
          TAG="sha-$(echo "$SHA" | cut -c1-7)"

          # Read the current stack so we can edit its environment in place.
          CURRENT=$(curl -sSf -X POST "${KOMODO_URL}/read" \
            -H "Content-Type: application/json" \
            -H "X-Api-Key: ${KOMODO_API_KEY}" \
            -H "X-Api-Secret: ${KOMODO_API_SECRET}" \
            -d '{"type": "GetStack", "params": {"stack": "pansy"}}')

          STACK_ID=$(echo "$CURRENT" | jq -r '._id["$oid"]')
          CURRENT_ENV=$(echo "$CURRENT" | jq -r '.config.environment')

          # Replace PANSY_TAG if present, else append it.
          if echo "$CURRENT_ENV" | grep -q "^PANSY_TAG="; then
            UPDATED_ENV=$(echo "$CURRENT_ENV" | sed "s/^PANSY_TAG=.*/PANSY_TAG=${TAG}/")
          else
            UPDATED_ENV=$(printf '%s\nPANSY_TAG=%s' "$CURRENT_ENV" "$TAG")
          fi

          curl -sSf -X POST "${KOMODO_URL}/write" \
            -H "Content-Type: application/json" \
            -H "X-Api-Key: ${KOMODO_API_KEY}" \
            -H "X-Api-Secret: ${KOMODO_API_SECRET}" \
            -d "$(jq -n --arg id "$STACK_ID" --arg env "$UPDATED_ENV" \
              '{"type": "UpdateStack", "params": {"id": $id, "config": {"environment": $env}}}')"

      - name: Deploy via Komodo
        if: (github.ref_name == 'main' || github.event_name == 'workflow_dispatch') && success()
        env:
          KOMODO_URL: ${{ secrets.KOMODO_URL }}
          KOMODO_API_KEY: ${{ secrets.KOMODO_API_KEY }}
          KOMODO_API_SECRET: ${{ secrets.KOMODO_API_SECRET }}
        run: |
          curl -sSf -X POST "${KOMODO_URL}/execute" \
            -H "Content-Type: application/json" \
            -H "X-Api-Key: ${KOMODO_API_KEY}" \
            -H "X-Api-Secret: ${KOMODO_API_SECRET}" \
            -d '{"type": "DeployStack", "params": {"stack": "pansy", "services": [], "stop_time": null}}'