name: Cloud Apache Container
run-name: ${{ gitea.actor }} pushed a change to trunk
on:
  push:
    branches:
      - trunk

jobs:
  # Shell gate. Runs FIRST and costs seconds; the images below do not depend on
  # it (a red job here does not block a push that is otherwise fine), but it is
  # the only place the ENTRYPOINT logic is executed at all. The .phpt suite and
  # the Dockerfile's `lsphp -i` probe both test the extension, and both were
  # green for the release whose entrypoint declared that same extension
  # missing — see scripts/tests/lsphp-info-probe.test.sh for what went wrong
  # and why it needed a test outside the image build to catch it.
  Shell-Checks:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      # Runner images differ on whether they are root and whether sudo exists.
      - name: Install shellcheck
        run: |
          if ! command -v shellcheck >/dev/null 2>&1; then
            (apt-get update && apt-get install -y shellcheck) ||
            (sudo apt-get update && sudo apt-get install -y shellcheck)
          fi
          shellcheck --version

      - name: Syntax check every shell script
        run: |
          set -euo pipefail
          find scripts ext -name '*.sh' -print0 | xargs -0 -n1 bash -n

      # Deliberately NOT repo-wide. The older scripts (entrypoint.sh,
      # entrypoint-fpm.sh, create-vhost.sh, create-php-config.sh,
      # detect-memory.sh) carry pre-existing SC2154/SC2027 findings that predate
      # this job; listing them here would make the gate red on arrival and
      # therefore ignored. This is the set that is clean today — the scripts
      # that run `set -o pipefail` plus the tests. Add files as they are fixed;
      # do not add one that is not yet clean.
      - name: shellcheck (warnings and above, on the clean set)
        run: |
          shellcheck -S warning \
            scripts/entrypoint-lsphp.sh \
            scripts/entrypoint-litespeed.sh \
            scripts/entrypoint-shared-ols.sh \
            scripts/render-shared-ols-config.sh \
            scripts/ols-htaccess-watcher.sh \
            scripts/create-vhost-litespeed.sh \
            scripts/install-lscache-wp.sh \
            scripts/tune-mpm.sh \
            scripts/tests/lsphp-info-probe.test.sh

      - name: lsphp probe regression test
        run: ./scripts/tests/lsphp-info-probe.test.sh

  Build-and-Push:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        phpver: [74, 80, 81, 82, 83, 84, 85]
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to Gitea
        uses: docker/login-action@v3
        with:
          registry: repo.anhonesthost.net
          username: ${{ secrets.CI_USER }}
          password: ${{ secrets.CI_TOKEN }}

      - name: Build and Push Image
        uses: docker/build-push-action@v6
        with:
          platforms: linux/amd64
          push: true
          build-args: |
            PHPVER=${{ matrix.phpver }}
          tags: |
            repo.anhonesthost.net/cloud-hosting-platform/cac:php${{ matrix.phpver }}
            ${{ matrix.phpver == '85' && 'repo.anhonesthost.net/cloud-hosting-platform/cac:latest' || '' }}

  Build-FPM-Images:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        phpver: [74, 80, 81, 82, 83, 84, 85]
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to Gitea
        uses: docker/login-action@v3
        with:
          registry: repo.anhonesthost.net
          username: ${{ secrets.CI_USER }}
          password: ${{ secrets.CI_TOKEN }}

      - name: Build and Push FPM Image
        uses: docker/build-push-action@v6
        with:
          file: ./Dockerfile.fpm
          platforms: linux/amd64
          push: true
          build-args: |
            PHPVER=${{ matrix.phpver }}
          tags: |
            repo.anhonesthost.net/cloud-hosting-platform/cac-fpm:php${{ matrix.phpver }}
            ${{ matrix.phpver == '85' && 'repo.anhonesthost.net/cloud-hosting-platform/cac-fpm:latest' || '' }}

  Build-LiteSpeed-Images:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        # PHP 7.4/8.0 deliberately excluded — the LiteSpeed prebuilt base
        # images stop at older OLS releases for those PHP versions, and the
        # cac-litespeed tier is a paid premium offering: 8.1+ is the
        # modernization story we're selling.
        phpver: [81, 82, 83, 84, 85]
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to Gitea
        uses: docker/login-action@v3
        with:
          registry: repo.anhonesthost.net
          username: ${{ secrets.CI_USER }}
          password: ${{ secrets.CI_TOKEN }}

      - name: Build and Push LiteSpeed Image
        uses: docker/build-push-action@v6
        with:
          file: ./Dockerfile.litespeed
          platforms: linux/amd64
          push: true
          build-args: |
            PHPVER=${{ matrix.phpver }}
            OLS_VERSION=1.8.4
          # OLS_VERSION pinned to 1.8.4 — only release with prebuilt images
          # for every PHP version we ship (1.8.5 and 1.9.0 don't have an
          # lsphp81 variant on Docker Hub). Bump alongside a local rebuild
          # test when LiteSpeed publishes lsphp81 on a newer OLS release.
          # See spec: docs/superpowers/specs/2026-06-01-cac-litespeed-design.md
          tags: |
            repo.anhonesthost.net/cloud-hosting-platform/cac-litespeed:php${{ matrix.phpver }}
            ${{ matrix.phpver == '85' && 'repo.anhonesthost.net/cloud-hosting-platform/cac-litespeed:latest' || '' }}

  Build-LSPHP-Images:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        # Same PHP matrix as cac-litespeed (81–85): cac-lsphp is the detached
        # backend for the shared-ols tier and shares the litespeed prebuilt
        # base, which only ships lsphp for 8.1+. Keep this matrix in lockstep
        # with Build-LiteSpeed-Images.
        phpver: [81, 82, 83, 84, 85]
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to Gitea
        uses: docker/login-action@v3
        with:
          registry: repo.anhonesthost.net
          username: ${{ secrets.CI_USER }}
          password: ${{ secrets.CI_TOKEN }}

      - name: Build and Push lsphp Image
        uses: docker/build-push-action@v6
        with:
          file: ./Dockerfile.lsphp
          platforms: linux/amd64
          push: true
          build-args: |
            PHPVER=${{ matrix.phpver }}
            OLS_VERSION=1.8.4
          # OLS_VERSION pinned to 1.8.4 to match Build-LiteSpeed-Images — same
          # prebuilt base, same lsphp binaries. Bump both together.
          tags: |
            repo.anhonesthost.net/cloud-hosting-platform/cac-lsphp:php${{ matrix.phpver }}
            ${{ matrix.phpver == '85' && 'repo.anhonesthost.net/cloud-hosting-platform/cac-lsphp:latest' || '' }}

  Build-Shared-httpd:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to Gitea
        uses: docker/login-action@v3
        with:
          registry: repo.anhonesthost.net
          username: ${{ secrets.CI_USER }}
          password: ${{ secrets.CI_TOKEN }}

      - name: Build and Push Shared httpd Image
        uses: docker/build-push-action@v6
        with:
          file: ./Dockerfile.shared-httpd
          platforms: linux/amd64
          push: true
          tags: |
            repo.anhonesthost.net/cloud-hosting-platform/shared-httpd:latest

  Build-Shared-OLS:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to Gitea
        uses: docker/login-action@v3
        with:
          registry: repo.anhonesthost.net
          username: ${{ secrets.CI_USER }}
          password: ${{ secrets.CI_TOKEN }}

      - name: Build and Push Shared OLS Image
        uses: docker/build-push-action@v6
        with:
          file: ./Dockerfile.shared-ols
          platforms: linux/amd64
          push: true
          # Single image (runs no PHP). PHPVER just selects the OLS base tag;
          # pinned to 83 / OLS 1.8.4 to match the rest of the litespeed family.
          build-args: |
            PHPVER=83
            OLS_VERSION=1.8.4
          tags: |
            repo.anhonesthost.net/cloud-hosting-platform/shared-ols:latest