name: Build container image

on:
  pull_request:
    branches:
      - main

  # schedule:
  #   - cron: '05 10 * * *'  # 10:05 UTC daily

  workflow_dispatch:

env:
  IMAGE_NAME: "${{ github.event.repository.name }}"
  IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}"
  DEFAULT_TAG: "stable"

concurrency:
  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
  cancel-in-progress: true

jobs:
  build_push:
    name: Build and push image (private)
    runs-on: ubuntu-24.04

    permissions:
      contents: read
      packages: write

    steps:
      - name: Prepare environment
        run: |
          echo "IMAGE_NAME=${IMAGE_NAME,,}" >> ${GITHUB_ENV}
          echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" >> ${GITHUB_ENV}

      - name: Checkout
        uses: actions/checkout@v5

      - name: Mount BTRFS for podman storage
        uses: ublue-os/container-storage-action@main
        continue-on-error: true
        with:
          target-dir: /var/lib/containers
          mount-opts: compress-force=zstd:2

      # Minimal, private metadata – no public URLs, no ArtifactHub
      - name: Image Metadata
        uses: docker/metadata-action@v5
        id: metadata
        with:
          tags: |
            type=raw,value=${{ env.DEFAULT_TAG }}
          labels: |
            org.opencontainers.image.title=${{ env.IMAGE_NAME }}
            org.opencontainers.image.version=${{ env.DEFAULT_TAG }}
            containers.bootc=1

      - name: Build Image
        uses: redhat-actions/buildah-build@v2
        with:
          containerfiles: |
            ./Containerfile
          image: ${{ env.IMAGE_NAME }}
          tags: ${{ env.DEFAULT_TAG }}
          labels: ${{ steps.metadata.outputs.labels }}
          oci: false

      - name: Login to GitHub Container Registry
        if: github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Push to GHCR (private)
        if: github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
        uses: redhat-actions/push-to-registry@v2
        with:
          registry: ${{ env.IMAGE_REGISTRY }}
          image: ${{ env.IMAGE_NAME }}
          tags: ${{ env.DEFAULT_TAG }}

      - name: Install Cosign
        if: github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
        uses: sigstore/cosign-installer@v4.1.0

      - name: Sign image (private)
        if: github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
        run: |
          cosign sign -y \
            --key env://COSIGN_PRIVATE_KEY \
            ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.DEFAULT_TAG }}
        env:
          COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}