name: Cloud Node Container
run-name: ${{ gitea.actor }} pushed a change to main
on:
  push:
    branches:
      - main

jobs:
  Build-and-Push:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        nodever: [18, 20, 22, 24, 26]
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      # Internal package cache (CT130 pkg-cache). Used ONLY if it answers over
      # TLS with our pinned CA; otherwise this job builds from the upstream repos
      # and Docker Hub exactly as before. Repo cache and registry mirror are
      # probed separately so either can fail back on its own.
      - name: Probe package cache
        id: pkgcache
        run: |
          url=""; mirror=""
          if curl -fsS --max-time 5 --cacert keys/pkg-cache/ca.crt -o /dev/null https://192.168.1.40/; then url="https://192.168.1.40"; fi
          if curl -fsS --max-time 5 --cacert keys/pkg-cache/ca.crt -o /dev/null https://192.168.1.40:5000/v2/; then mirror="192.168.1.40:5000"; fi
          echo "pkg-cache: repos=${url:-<unreachable: upstream>} registry-mirror=${mirror:-<unreachable: Docker Hub>}"
          [ -n "$url" ] || echo "::warning::pkg-cache unreachable - building from upstream repositories"
          echo "url=${url}" >> "$GITHUB_OUTPUT"
          echo "mirror=${mirror}" >> "$GITHUB_OUTPUT"

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      # BuildKit ignores dockerd's registry-mirrors, so the mirror is set on the
      # builder; BuildKit still falls back to Docker Hub if the mirror stops.
      - name: Set up Docker Buildx (Docker Hub via pkg-cache mirror)
        if: steps.pkgcache.outputs.mirror != ''
        uses: docker/setup-buildx-action@v3
        with:
          buildkitd-config-inline: |
            [registry."docker.io"]
              mirrors = ["192.168.1.40:5000"]
            [registry."192.168.1.40:5000"]
              ca = ["${{ github.workspace }}/keys/pkg-cache/ca.crt"]

      - name: Set up Docker Buildx
        if: steps.pkgcache.outputs.mirror == ''
        uses: docker/setup-buildx-action@v3

      - name: Login to Gitea
        uses: docker/login-action@v3
        with:
          registry: repo.anhonesthost.net
          username: ${{ secrets.CI_USER }}
          password: ${{ secrets.CI_TOKEN }}

      - name: Build and Push Image
        uses: docker/build-push-action@v6
        with:
          platforms: linux/amd64
          push: true
          build-args: |
            NODEVER=${{ matrix.nodever }}
            PKG_CACHE=${{ steps.pkgcache.outputs.url }}
          tags: |
            repo.anhonesthost.net/cloud-hosting-platform/cnoc:node${{ matrix.nodever }}
            ${{ matrix.nodever == '20' && 'repo.anhonesthost.net/cloud-hosting-platform/cnoc:latest' || '' }}