name: publish-client-image

# Builds the redapricot Go client into a container image with ko and pushes it to
# the GitHub Container Registry (ghcr.io). Triggers on version tags and manual dispatch.
on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      tag:
        description: 'Extra image tag to publish (in addition to the git ref)'
        required: false
        default: ''

permissions:
  contents: read
  packages: write # lets the built-in GITHUB_TOKEN push packages to ghcr.io

env:
  # Image repository on ghcr.io: ghcr.io/<owner>/<name> (must be lowercase).
  KO_DOCKER_REPO: ghcr.io/saltedfishclub/redapricot-client

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
          cache: true

      - uses: ko-build/setup-ko@v0.9

      - name: Derive image tags
        id: meta
        run: |
          tags="${GITHUB_REF_NAME},sha-${GITHUB_SHA::7}"
          if [ -n "${{ github.event.inputs.tag }}" ]; then
            tags="${tags},${{ github.event.inputs.tag }}"
          fi
          echo "tags=${tags}" >> "$GITHUB_OUTPUT"

      # Authenticate to ghcr.io with the workflow's built-in GITHUB_TOKEN — no repo
      # secrets needed. ko reads the Docker credentials this step writes, so it
      # pushes as the same authenticated user.
      - name: Log in to ghcr.io
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push image with ko
        run: |
          ko build ./cmd/redapricot-client \
            --bare \
            --platform=linux/amd64,linux/arm64 \
            --tags "${{ steps.meta.outputs.tags }}"