kadence/.gitea/workflows/docker.yml

# Build the backend + web image and push it to this Gitea's own registry.
#
# The image is the same one `docker compose` builds locally — one Dockerfile,
# two stages, Vite's output baked in and served from the same origin as the API.
# Tagged twice: `latest` for the deploy script to pull, and the short commit for
# every build to be nameable after the fact.
#
# Needs a runner that can reach a docker daemon. The compose service in
# `docker-compose.ci.yml` mounts the host's socket into the job container, which
# is the usual arrangement for a single-machine Gitea.
name: docker

on:
  push:
    branches: [master]
    tags: ["v*"]

# The built-in job token (`secrets.GITEA_TOKEN`) **cannot** publish packages on
# Gitea — `permissions:` has no effect on container pushes, and the job token is
# read-only there by design. Publishing therefore needs a personal access token
# with `package:write`, stored as REGISTRY_TOKEN. Without it the image is still
# built and smoke-tested, but not pushed; that keeps the build honest without
# failing every push on a repository that has not minted a token yet.
permissions:
  contents: read

env:
  REGISTRY: git.timka.su
  IMAGE: git.timka.su/timka123/kadence

jobs:
  image:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Check the daemon is reachable
        run: docker version

      - name: Log in to the Gitea registry
        id: login
        env:
          # The username is only needed to pair with the token. Default it to the
          # repository owner — the same account the image namespace belongs to —
          # so a missing REGISTRY_USER secret does not fail the job with docker's
          # unhelpful "username is empty".
          REGISTRY_USER: ${{ secrets.REGISTRY_USER || github.repository_owner }}
          # A personal access token with `package:write`. The built-in job token
          # is not usable here: Gitea's job token is read-only for packages (its
          # `permissions:` support does not cover the container registry yet),
          # so falling back to it only produces a confusing 401.
          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
        run: |
          if [ -z "$REGISTRY_USER" ] || [ -z "$REGISTRY_TOKEN" ]; then
            echo "::warning::No REGISTRY_TOKEN (a personal access token with package:write) — the image will be built and smoke-tested but not pushed. Add it under Settings → Actions → Secrets to publish."
            echo "push=false" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          printf '%s' "$REGISTRY_TOKEN" \
            | docker login "$REGISTRY" -u "$REGISTRY_USER" --password-stdin
          echo "push=true" >> "$GITHUB_OUTPUT"

      - name: Build
        run: |
          SHORT="$(git rev-parse --short HEAD)"
          echo "SHORT=$SHORT" >> "$GITHUB_ENV"
          docker build -t "$IMAGE:$SHORT" -t "$IMAGE:latest" .

      - name: Smoke-test the image before it is published
        run: |
          # A tag nobody can run is worse than no tag. SQLite keeps this to one
          # container: no database service, no network, no .env.
          #
          # No `-p`: the job itself runs in a container and talks to the host's
          # docker daemon through the mounted socket, so a published port lands
          # on the *host*, where this container's 127.0.0.1 cannot see it. Curl
          # from inside the smoke container instead, which also exercises the
          # image exactly as it will run.
          docker run -d --name kadence-smoke \
            -e DATABASE_URL="sqlite:///./kadence.db" \
            -e SCHEDULER_ENABLED=0 -e TELEGRAM_BOT_ENABLED=0 \
            "$IMAGE:$SHORT"

          cleanup() {
            docker logs kadence-smoke 2>&1 | tail -20 || true
            docker rm -f kadence-smoke >/dev/null 2>&1 || true
          }
          trap cleanup EXIT

          for _ in $(seq 1 30); do
            if docker exec kadence-smoke curl -fsS http://localhost:8000/api/health >/dev/null 2>&1; then
              echo "healthy"
              break
            fi
            # Fail fast instead of waiting out the loop when the app crashed.
            if [ "$(docker inspect -f '{{.State.Running}}' kadence-smoke)" != "true" ]; then
              echo "::error::smoke container exited before becoming healthy"
              exit 1
            fi
            sleep 2
          done

          docker exec kadence-smoke curl -fsS http://localhost:8000/api/health

      - name: Push
        if: steps.login.outputs.push == 'true'
        run: |
          docker push "$IMAGE:$SHORT"
          docker push "$IMAGE:latest"

      - name: Push the tag, when there is one
        if: steps.login.outputs.push == 'true' && startsWith(github.ref, 'refs/tags/v')
        run: |
          VERSION="${GITHUB_REF#refs/tags/}"
          docker tag "$IMAGE:$SHORT" "$IMAGE:$VERSION"
          docker push "$IMAGE:$VERSION"