name: Build and Push Production Image

# Builds the production image and pushes it to the Forgejo registry.
# TAG-PUSH ONLY: triggers exclusively on a v* tag (e.g. v0.3.0) — never on a
# branch push or PR. This matches the release flow: merge to main → CI green →
# cut a v* tag → that tag (and only that tag) builds + publishes the image.
on:
  push:
    tags: ['v*']

jobs:
  build:
    runs-on: docker
    container:
      image: catthehacker/ubuntu:act-latest

    steps:
      - uses: https://data.forgejo.org/actions/checkout@v4

      - name: Set up Docker Buildx
        uses: https://data.forgejo.org/docker/setup-buildx-action@v3

      - name: Login to Forgejo Registry
        uses: https://data.forgejo.org/docker/login-action@v3
        with:
          registry: forge.lvl0.xyz
          # Forgejo mirrors GitHub's context naming, so `github.actor` resolves to
          # the user who pushed the tag (there is no `forgejo.actor`).
          username: ${{ github.actor }}
          password: ${{ secrets.REGISTRY_TOKEN }}

      - name: Build and push
        uses: https://data.forgejo.org/docker/build-push-action@v5
        with:
          context: .
          # The repo Dockerfile is multi-target; the production stage is
          # frankenphp_prod (compiles the frontend in frontend_builder + bundles
          # the dist into the FrankenPHP image).
          target: frankenphp_prod
          build-args: |
            NPM_VERSION=11.17.0
          platforms: linux/amd64
          push: true
          tags: |
            forge.lvl0.xyz/lvl0/buckets:${{ github.ref_name }}
            forge.lvl0.xyz/lvl0/buckets:latest