name: Build Docker Image
run-name: ${{ gitea.actor }} building ${{ gitea.ref_name }}
on:
  push:
    branches:
      - main
      - dev

jobs:
  Docker-Build:
    runs-on: ubuntu-latest
    steps:
      - name: Clone Repository
        uses: actions/checkout@v4

      - name: Fix DNS for registry
        run: |
          echo "185.243.8.189 docker.srsoftware.de" | sudo tee -a /etc/hosts
          getent hosts docker.srsoftware.de

      - name: Debug DNS + TLS from runner
        run: |
          apt update
          apt install -y dnsutils openssl
          set -x
          getent hosts docker.srsoftware.de || true
          dig +short docker.srsoftware.de || true
          dig @8.8.8.8 docker.srsoftware.de +short || true
          dig @1.1.1.1 docker.srsoftware.de +short || true
          dig @$(awk 'NR==1{print $2}' /etc/resolv.conf) docker.srsoftware.de +short || true

      - name: Debug certificate (runner)
        run: |
          set -x
          echo | openssl s_client -connect docker.srsoftware.de:443 -servername docker.srsoftware.de 2>/dev/null \
            | openssl x509 -noout -subject -issuer -ext subjectAltName
          echo | openssl s_client -connect 46.38.238.106:443 -servername docker.srsoftware.de 2>/dev/null \
            | openssl x509 -noout -ext subjectAltName
          echo | openssl s_client -connect 185.243.8.189:443 -servername docker.srsoftware.de 2>/dev/null \
            | openssl x509 -noout -ext subjectAltName

      - name: Login to registry
        uses: docker/login-action@v2
        with:
          registry: docker.srsoftware.de
          username: ${{ secrets.REGISTRY_USER }}
          password: ${{ secrets.REGISTRY_PASS }}

      - name: Build docker image
        run: docker build -t umbrella .

      - name: Store tag date
        run: |
          TAG=$(date +%Y%m%d_%H%M)_${{ gitea.ref_name }}
          echo $TAG > /tmp/tag
          echo Using '"'$TAG'"' as tag.

      - name: Tag image for upload
        run: |
          TAG=$(cat /tmp/tag)
          docker tag umbrella ${{ secrets.REGISTRY_PATH }}/umbrella:${{ gitea.ref_name }}
          docker tag umbrella ${{ secrets.REGISTRY_PATH }}/umbrella:$TAG

      - name: Push to registry
        run: |
          TAG=$(cat /tmp/tag)
          docker push ${{ secrets.REGISTRY_PATH }}/umbrella:${{ gitea.ref_name }}
          docker push ${{ secrets.REGISTRY_PATH }}/umbrella:$TAG

  Clean-Registry:
    runs-on: ubuntu-latest
    steps:
      - name: Get tag list
        run: |
          TAGS="$(curl -s -u "${{ secrets.REGISTRY_USER }}:${{ secrets.REGISTRY_PASS }}" https://${{ secrets.REGISTRY_PATH }}/v2/umbrella/tags/list | jq -r ".tags[]")"
          COUNT=$(echo "$TAGS" | wc -l)
          echo found $COUNT tags: $TAGS
          if [ $COUNT -gt 10 ]; then
            REMAIN=$((COUNT - 10))
            echo $REMAIN tags will be kept!
            echo "$TAGS" | head -n $REMAIN > /tmp/old_tags
          else
            echo less than 10 tags, skipping cleanup
            echo "" > /tmp/old_tags
          fi

      - name: Remove tags
        run: |
          cat /tmp/old_tags | while read TAG; do
            if [ -n "$TAG" ]; then
              DIGEST=$(curl -u "${{ secrets.REGISTRY_USER }}:${{ secrets.REGISTRY_PASS }}" -sS -H 'Accept: application/vnd.docker.distribution.manifest.v2+json' -o /dev/null -w '%header{Docker-Content-Digest}' https://${{ secrets.REGISTRY_PATH }}/v2/umbrella/manifests/$TAG)
              if [ -n "$DIGEST" ]; then
                echo about to delete $TAG
                curl -u "${{ secrets.REGISTRY_USER }}:${{ secrets.REGISTRY_PASS }}" -sS -X DELETE https://${{ secrets.REGISTRY_PATH }}/v2/umbrella/manifests/$DIGEST
              else
                echo failed to get digest for $TAG
              fi
            fi
          done