kadence/.gitea/workflows/docker.yml

# Build the backend + web image and push it to this Gitea's own registry.
#
# The image is the same one `docker compose` builds locally — one Dockerfile,
# two stages, Vite's output baked in and served from the same origin as the API.
# Tagged twice: `latest` for the deploy script to pull, and the short commit for
# every build to be nameable after the fact.
#
# Needs a runner that can reach a docker daemon. The compose service in
# `docker-compose.ci.yml` mounts the host's socket into the job container, which
# is the usual arrangement for a single-machine Gitea.
name: docker

on:
  push:
    branches: [master]
    tags: ["v*"]

# The built-in job token is enough to push to this instance's own registry; a
# REGISTRY_TOKEN secret is only needed when it is not (an older Gitea, or a
# restricted default permission mode). Ask for packages: write explicitly so the
# token is not silently read-only on instances that default to restricted.
permissions:
  contents: read
  packages: write

env:
  REGISTRY: git.timka.su
  IMAGE: git.timka.su/timka123/kadence

jobs:
  image:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Check the daemon is reachable
        run: docker version

      - name: Log in to the Gitea registry
        env:
          # The username is only needed to pair with the token. Default it to the
          # repository owner — the same account the image namespace belongs to —
          # so a missing REGISTRY_USER secret does not fail the job with docker's
          # unhelpful "username is empty".
          REGISTRY_USER: ${{ secrets.REGISTRY_USER || github.repository_owner }}
          # Gitea gives every job a built-in token (secrets.GITEA_TOKEN). Prefer
          # an explicit secret, but fall back to that token so a fresh repository
          # publishes without anyone having to mint one by hand.
          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN || secrets.GITEA_TOKEN }}
        run: |
          if [ -z "$REGISTRY_USER" ] || [ -z "$REGISTRY_TOKEN" ]; then
            echo "::error::Container registry credentials are missing. Set REGISTRY_TOKEN (a token with package:write) under Settings → Actions → Secrets; REGISTRY_USER is optional and defaults to the repository owner."
            exit 1
          fi
          printf '%s' "$REGISTRY_TOKEN" \
            | docker login "$REGISTRY" -u "$REGISTRY_USER" --password-stdin

      - name: Build
        run: |
          SHORT="$(git rev-parse --short HEAD)"
          echo "SHORT=$SHORT" >> "$GITHUB_ENV"
          docker build -t "$IMAGE:$SHORT" -t "$IMAGE:latest" .

      - name: Smoke-test the image before it is published
        run: |
          # A tag nobody can run is worse than no tag. SQLite keeps this to one
          # container: no database service, no network, no .env.
          docker run -d --name kadence-smoke \
            -e DATABASE_URL="sqlite:///./kadence.db" \
            -e SCHEDULER_ENABLED=0 -e TELEGRAM_BOT_ENABLED=0 \
            -p 18000:8000 "$IMAGE:$SHORT"
          for _ in $(seq 1 30); do
            if curl -fsS http://127.0.0.1:18000/api/health >/dev/null 2>&1; then
              echo "healthy"; break
            fi
            sleep 2
          done
          curl -fsS http://127.0.0.1:18000/api/health
          docker logs kadence-smoke | tail -20
          docker rm -f kadence-smoke

      - name: Push
        run: |
          docker push "$IMAGE:$SHORT"
          docker push "$IMAGE:latest"

      - name: Push the tag, when there is one
        if: startsWith(github.ref, 'refs/tags/v')
        run: |
          VERSION="${GITHUB_REF#refs/tags/}"
          docker tag "$IMAGE:$SHORT" "$IMAGE:$VERSION"
          docker push "$IMAGE:$VERSION"