---
name: ci

on:
  push:
    branches: [main, dev]
  pull_request: {}

jobs:
  test:
    runs-on: debian-13
    steps:
      - uses: actions/checkout@v4
      - name: Run CI tests
        run: |
          set -euxo pipefail
          pwd
          ls -l Makefile
          command -v make
          command -v go
          command -v node
          command -v python3
          go version
          node --version
          make ci-test

  build:
    if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev')
    needs: test
    runs-on: scrapecast-build
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4
      - name: Login to the loopback Forgejo registry
        env:
          REGISTRY_USERNAME: "${{ secrets.REGISTRY_USERNAME }}"
          REGISTRY_PASSWORD: "${{ secrets.REGISTRY_PASSWORD }}"
        run: |
          set -euo pipefail
          # Runner PrivateTmp hides /tmp from the user Podman service. Keep
          # remote client files in the workspace so login, push, and Cosign
          # see the same Docker-compatible auth file.
          export DOCKER_CONFIG="${GITHUB_WORKSPACE}/.ci-registry"
          mkdir -p "$DOCKER_CONFIG"
          REGISTRY_AUTH="$(printf '%s:%s' "$REGISTRY_USERNAME" "$REGISTRY_PASSWORD" | base64 -w0)"
          printf '{"auths":{"127.0.0.1:13000":{"auth":"%s"}}}\n' \
            "$REGISTRY_AUTH" > "$DOCKER_CONFIG/config.json"
          chmod 0600 "$DOCKER_CONFIG/config.json"
      - name: Build and push images
        env:
          COSIGN_PRIVATE_KEY: "${{ secrets.COSIGN_PRIVATE_KEY }}"
          COSIGN_PASSWORD: "${{ secrets.COSIGN_PASSWORD }}"
        run: |
          set -euo pipefail
          REG=127.0.0.1:13000
          NS="${{ forgejo.repository }}"
          SHA="${{ forgejo.sha }}"
          export DOCKER_CONFIG="${GITHUB_WORKSPACE}/.ci-registry"
          COSIGN_HOME="$XDG_CACHE_HOME/cosign-home"
          mkdir -p "$COSIGN_HOME" "$DOCKER_CONFIG"
          case "${{ github.ref_name }}" in
            main|dev) CHANNEL="${{ github.ref_name }}" ;;
            *) echo "unsupported deployment branch" >&2; exit 1 ;;
          esac
          for img in scraper web evasion; do
            podman --remote build --pull=newer \
              -t "$REG/$NS/$img:$SHA" \
              -t "$REG/$NS/$img:$CHANNEL" \
              "./$img"
            trivy image \
              --image-src podman \
              --scanners vuln \
              --report summary \
              --ignore-unfixed \
              --severity HIGH,CRITICAL \
              --exit-code 1 \
              "$REG/$NS/$img:$CHANNEL"
            podman --remote push \
              --authfile "$DOCKER_CONFIG/config.json" \
              --tls-verify=false \
              "$REG/$NS/$img:$SHA"
            DIGEST_FILE="$DOCKER_CONFIG/${img}.digest"
            : > "$DIGEST_FILE"
            podman --remote push \
              --authfile "$DOCKER_CONFIG/config.json" \
              --digestfile "$DIGEST_FILE" \
              --tls-verify=false \
              "$REG/$NS/$img:$CHANNEL"
            DIGEST="$(tr -d '\n' < "$DIGEST_FILE")"
            if ! printf '%s\n' "$DIGEST" | grep -Eq '^sha256:[0-9a-f]{64}$'; then
              DIGEST="$(podman --remote image inspect --format '{{.Digest}}' \
                "$REG/$NS/$img:$CHANNEL")"
            fi
            if ! printf '%s\n' "$DIGEST" | grep -Eq '^sha256:[0-9a-f]{64}$'; then
              echo "registry returned an invalid image digest" >&2
              exit 1
            fi
            HOME="$COSIGN_HOME" COSIGN_PASSWORD="$COSIGN_PASSWORD" \
              cosign sign --yes \
              --allow-insecure-registry \
              --key env://COSIGN_PRIVATE_KEY \
              --annotations "repository=$NS" \
              --annotations "branch=$CHANNEL" \
              "$REG/$NS/$img@$DIGEST"
            podman --remote rmi "$REG/$NS/$img:$SHA" || true
          done
          podman --remote image prune --force