# Build and publish here; k8s-helper deploys ./deploy/k8s after the webhook.
name: build

on:
  push:
    branches: [main]

env:
  IMAGE: registry.k6n.net/fancydns

jobs:
  build-push:
    runs-on: amd64
    steps:
      - uses: actions/checkout@v4

      - name: Build image
        run: |
          docker build --build-arg VERSION=${{ gitea.sha }} \
            -t $IMAGE:${{ gitea.sha }} -t $IMAGE:latest .

      - name: Push image
        run: |
          docker push $IMAGE:${{ gitea.sha }}
          docker push $IMAGE:latest

      - name: Reconcile after image is published
        env:
          GITOPS_WEBHOOK_SECRET: ${{ secrets.GITOPS_WEBHOOK_SECRET }}
        run: |
          if [ -z "$GITOPS_WEBHOOK_SECRET" ]; then
            echo "GITOPS_WEBHOOK_SECRET must match the k8s-helper Gitea webhook secret" >&2
            exit 1
          fi
          payload="$(mktemp)"
          trap 'rm -f "$payload"' EXIT
          printf '{"ref":"%s","after":"%s","repository":{"clone_url":"https://git.k6n.net/mats/fancy-dns.git","ssh_url":"git@git.k6n.net:mats/fancy-dns.git"}}' \
            "$GITHUB_REF" "$GITHUB_SHA" > "$payload"
          signature="$(openssl dgst -sha256 -hmac "$GITOPS_WEBHOOK_SECRET" "$payload" | awk '{print $NF}')"
          curl --fail --silent --show-error \
            -X POST \
            -H "Content-Type: application/json" \
            -H "X-Gitea-Event: push" \
            -H "X-Gitea-Signature: $signature" \
            --data-binary "@$payload" \
            https://ui.k6n.net/api/gitops/webhooks/gitea