name: Build and Publish Container

on:
  push:
    branches:
      - main
    tags:
      - "v*"
  workflow_dispatch:

jobs:
  publish:
    runs-on: ubuntu-latest
    env:
      REGISTRY: gitea.dddbg.com
      IMAGE: gitea.dddbg.com/youbin/stun-nat
    steps:
      - name: Check out source
        uses: actions/checkout@v4

      - name: Log in to Gitea Container Registry
        env:
          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
        run: |
          test -n "$REGISTRY_TOKEN" || { echo "Missing Actions secret: REGISTRY_TOKEN"; exit 1; }
          printf '%s' "$REGISTRY_TOKEN" | docker login "$REGISTRY" --username youbin --password-stdin

      - name: Build and push image
        run: |
          push_image() {
            local image="$1"
            local attempt=1
            until docker push "$image"; do
              if [ "$attempt" -ge 3 ]; then
                echo "Failed to push ${image} after ${attempt} attempts"
                return 1
              fi
              attempt=$((attempt + 1))
              echo "Push failed; retrying ${image} (${attempt}/3) in 10 seconds"
              sleep 10
            done
          }

          SHA_TAG="sha-${GITHUB_SHA}"
          docker build --pull --tag "${IMAGE}:${SHA_TAG}" .
          push_image "${IMAGE}:${SHA_TAG}"

          if [ "$GITHUB_REF" = "refs/heads/main" ]; then
            docker tag "${IMAGE}:${SHA_TAG}" "${IMAGE}:latest"
            push_image "${IMAGE}:latest"
          fi

          case "$GITHUB_REF" in
            refs/tags/v*)
              docker tag "${IMAGE}:${SHA_TAG}" "${IMAGE}:${GITHUB_REF_NAME}"
              push_image "${IMAGE}:${GITHUB_REF_NAME}"
              ;;
          esac