name: CI | Docker Image engine-cyberia

on:
  workflow_dispatch:

env:
  UNDERPOST_VERSION: '3.5.0'

jobs:
  build-and-push:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write

    steps:
      - uses: actions/checkout@v7

      - name: Setup Node.js
        uses: actions/setup-node@v7
        with:
          node-version: '24.x'

      - name: Install engine dependencies
        run: npm ci --ignore-scripts

      - name: Stage underpost CLI package
        # Bakes the CLI into the image from this checkout instead of the registry, so a starting
        # pod never fetches it. The Dockerfiles COPY underpost-cli.tgz from the build context,
        # which for this workflow is the repository root.
        run: node bin/cyberia run-workflow stage-cli --output-path .

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Login to Docker Hub
        uses: docker/login-action@v4
        with:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}

      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: underpost/engine-cyberia
          tags: |
            type=raw,value=v${{ env.UNDERPOST_VERSION }}
            type=raw,value=latest
      # type=ref,event=branch
      # type=sha,prefix=sha-

      - name: Build and push image
        uses: docker/build-push-action@v7
        with:
          context: .
          file: ./src/runtime/engine-cyberia/Dockerfile
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

          build-args: |
            UNDERPOST_VERSION=${{ env.UNDERPOST_VERSION }}

          secrets: |
            github_token=${{ secrets.GITHUB_TOKEN }}
            github_username=${{ github.actor }}