name: Generic Container CI/CD

on:
  workflow_call:
    inputs:
      image_name:
        description: Fully qualified Gitea Registry image repository without a tag
        required: true
        type: string
      dockerfile:
        required: false
        default: Dockerfile
        type: string
      build_context:
        required: false
        default: .
        type: string
      test_command:
        description: Optional source-level test command
        required: false
        default: ""
        type: string
      deploy_service:
        description: Dev service to candidate-test and promote
        required: false
        default: ""
        type: string
      deploy_host:
        description: Restricted Dev deployment host
        required: false
        default: ""
        type: string
    secrets:
      REGISTRY_USERNAME:
        required: true
      REGISTRY_PASSWORD:
        required: true
      DEV_DEPLOY_SSH_KEY:
        required: false

jobs:
  test-build-publish:
    runs-on: ubuntu-22.04
    steps:
      - uses: https://gitea.waternetwork.cn/actions/checkout@v4
        with:
          fetch-depth: 1
      - name: Source tests
        if: ${{ inputs.test_command != '' }}
        run: ${{ inputs.test_command }}
      - name: Build immutable candidate image
        run: |
          set -eu
          docker build --pull=false -f "${{ inputs.dockerfile }}" \
            -t "${{ inputs.image_name }}:sha-${GITEA_SHA}" "${{ inputs.build_context }}"
      - name: Login and publish candidate image
        env:
          REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
        run: |
          set -eu
          registry="$(printf '%s' '${{ inputs.image_name }}' | cut -d/ -f1)"
          printf '%s' "$REGISTRY_PASSWORD" | docker login "$registry" -u "$REGISTRY_USERNAME" --password-stdin
          docker push "${{ inputs.image_name }}:sha-${GITEA_SHA}"
      - name: Candidate pull on Dev
        if: ${{ inputs.deploy_service != '' && inputs.deploy_host != '' }}
        env:
          DEV_DEPLOY_SSH_KEY: ${{ secrets.DEV_DEPLOY_SSH_KEY }}
        run: |
          set -eu
          test -n "$DEV_DEPLOY_SSH_KEY"
          install -d -m 700 ~/.ssh
          printf '%s\n' "$DEV_DEPLOY_SSH_KEY" > ~/.ssh/id_ed25519
          chmod 600 ~/.ssh/id_ed25519
          ssh-keyscan -H "${{ inputs.deploy_host }}" >> ~/.ssh/known_hosts
          ssh -i ~/.ssh/id_ed25519 cicd-deploy@"${{ inputs.deploy_host }}" \
            "candidate ${{ inputs.deploy_service }} ${{ inputs.image_name }}:sha-${GITEA_SHA}"
      - name: Promote tagged release after candidate check
        if: ${{ startsWith(gitea.ref, 'refs/tags/v') && inputs.deploy_service != '' && inputs.deploy_host != '' }}
        env:
          DEV_DEPLOY_SSH_KEY: ${{ secrets.DEV_DEPLOY_SSH_KEY }}
        run: |
          set -eu
          ssh -i ~/.ssh/id_ed25519 cicd-deploy@"${{ inputs.deploy_host }}" \
            "promote ${{ inputs.deploy_service }} ${{ inputs.image_name }}:sha-${GITEA_SHA}"