name: Verify and publish container

on:
  push:
    branches:
      - main

jobs:
  build-and-push:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Log into Local Registry
        run: |
          echo "${{ secrets.FORGEJO_PAT }}" | docker login git.elijahkuntz.com -u "${{ gitea.actor }}" --password-stdin

      - name: Install locked dependencies
        run: npm ci

      - name: Run tests
        run: npm test

      - name: Validate Prisma schema and migration drift
        run: |
          npx prisma validate
          DATABASE_URL=file:./ci-migration.test.db npx prisma migrate deploy
          npx prisma migrate diff --from-migrations prisma/migrations --to-schema prisma/schema.prisma --exit-code

      - name: Build application
        run: npm run build

      - name: Lint changed source files
        run: |
          FILES=$(git diff --name-only HEAD^ HEAD -- '*.ts' '*.tsx' '*.js' '*.mjs')
          if [ -n "$FILES" ]; then npx eslint $FILES; fi

      - name: Build and smoke production image
        run: |
          IMAGE_PATH=$(echo "git.elijahkuntz.com/${{ gitea.actor }}/${{ github.event.repository.name }}" | tr '[:upper:]' '[:lower:]')
          IMAGE_SHA="$IMAGE_PATH:${{ github.sha }}"
          CI_SECRET=$(openssl rand -hex 32)
          docker build -t "$IMAGE_SHA" .
          docker run -d --name study-smoke -p 3000:3726 -e SESSION_SECRET="$CI_SECRET" -e ALLOW_INITIAL_SETUP=true "$IMAGE_SHA"
          for attempt in $(seq 1 30); do
            if [ "$(docker inspect --format='{{.State.Health.Status}}' study-smoke)" = "healthy" ]; then break; fi
            sleep 2
          done
          test "$(docker inspect --format='{{.State.Health.Status}}' study-smoke)" = "healthy"
          curl --fail http://127.0.0.1:3000/login > /dev/null
          curl --fail http://127.0.0.1:3000/api/auth/setup-status | grep '"setupRequired":true'
          docker rm -f study-smoke
          docker tag "$IMAGE_SHA" "$IMAGE_PATH:latest"
          docker push "$IMAGE_SHA"
          docker push "$IMAGE_PATH:latest"