name: Generic Container CI/CD

on:
  workflow_call:
    inputs:
      image_name:
        description: Fully qualified image repository without a tag
        required: true
        type: string
      dockerfile:
        required: false
        default: Dockerfile
        type: string
      build_context:
        required: false
        default: .
        type: string
      test_command:
        description: Source-level test command supplied by the calling repository
        required: false
        default: ""
        type: string
      image_test_command:
        description: Optional command executed inside the built image
        required: false
        default: ""
        type: string
      candidate_command:
        description: Optional Dev candidate-stack command executed after image push
        required: false
        default: ""
        type: string
      promote_command:
        description: Optional atomic Dev promotion command executed only for v* tags
        required: false
        default: ""
        type: string
    secrets:
      REGISTRY_USERNAME:
        required: true
      REGISTRY_PASSWORD:
        required: true
      DEV_DEPLOY_SSH_KEY:
        required: false

jobs:
  test-build-publish:
    runs-on: ubuntu-22.04
    outputs:
      image_tag: ${{ steps.meta.outputs.image_tag }}
    steps:
      - uses: actions/checkout@v4
      - id: meta
        run: echo "image_tag=sha-${GITEA_SHA}" >> "$GITHUB_OUTPUT"
      - name: Source tests
        if: ${{ inputs.test_command != '' }}
        run: ${{ inputs.test_command }}
      - name: Build immutable candidate image
        run: docker build --pull=false -f "${{ inputs.dockerfile }}" -t "${{ inputs.image_name }}:sha-${GITEA_SHA}" "${{ inputs.build_context }}"
      - name: Image tests
        if: ${{ inputs.image_test_command != '' }}
        run: docker run --rm "${{ inputs.image_name }}:sha-${GITEA_SHA}" sh -lc '${{ inputs.image_test_command }}'
      - name: Publish candidate image
        env:
          REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
        run: |
          set -eu
          registry="$(printf '%s' '${{ inputs.image_name }}' | cut -d/ -f1)"
          printf '%s' "$REGISTRY_PASSWORD" | docker login "$registry" -u "$REGISTRY_USERNAME" --password-stdin
          docker push "${{ inputs.image_name }}:sha-${GITEA_SHA}"
      - name: Candidate test on Dev
        if: ${{ inputs.candidate_command != '' && secrets.DEV_DEPLOY_SSH_KEY != '' }}
        env:
          DEV_DEPLOY_SSH_KEY: ${{ secrets.DEV_DEPLOY_SSH_KEY }}
        run: |
          set -eu
          install -m 700 -d ~/.ssh
          printf '%s\n' "$DEV_DEPLOY_SSH_KEY" > ~/.ssh/id_ed25519
          chmod 600 ~/.ssh/id_ed25519
          ${{ inputs.candidate_command }} "${{ inputs.image_name }}:sha-${GITEA_SHA}"
      - name: Promote release after candidate health check
        if: ${{ startsWith(gitea.ref, 'refs/tags/v') && inputs.promote_command != '' && secrets.DEV_DEPLOY_SSH_KEY != '' }}
        run: ${{ inputs.promote_command }} "${{ inputs.image_name }}:sha-${GITEA_SHA}"