name: build-secretsserver

on:
  push:
    branches:
      - main
  # Only run on release tags.
  tags: ["v*"]
  pull_request:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5

      # Unfortunately gotta use a PAT,
      # workflow tokens can't access the registry yet.
      - name: Log in to the registry
        if: ${{ gitea.ref_type == 'tag' }}
        uses: docker/login-action@v3
        with:
          registry: git.handmadecities.com
          username: ${{ secrets.REGISTRY_USER }}
          password: ${{ secrets.REGISTRY_TOKEN }}

      - name: Compute tags
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: git.handmadecities.com/${{ gitea.repository }}/secretsserver
          tags: |
            type=semver,pattern={{version}}

      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          file: docker/secretsserver/Dockerfile
          context: .
          # Only push on releases.
          push: ${{ gitea.ref_type == 'tag' }}
          tags: ${{ steps.meta.outputs.tags }}