name: 🐳 Build ubuntu-latest Runner Image

on:
  push:
    branches:
      - main
    paths:
      - 'docker-ubuntu-latest/Dockerfile'
  workflow_dispatch:

jobs:
  build:
    # Runs directly on runner host — buildah+skopeo available via tools volume
    # No container spawned, no internet required in container
    runs-on: docker

    steps:
      - name: 🔎 Checkout
        run: |
          git clone \
            --depth 1 \
            --branch "${{ gitea.ref_name }}" \
            "http://${{ secrets.REGISTRY_USER }}:${{ secrets.REGISTRY_PASSWORD }}@gitea.mod.home/ansible/ansible-runner.git" \
            .

      - name: 🏷️ Set Image Tags
        id: tags
        run: |
          REGISTRY="gitea.mod.home"
          ORG="${{ gitea.repository_owner }}"
          IMAGE="ubuntu-act-runner"
          SHORT_SHA="${{ gitea.sha }}"
          SHORT_SHA="${SHORT_SHA:0:8}"

          echo "tag_latest=${REGISTRY}/${ORG}/${IMAGE}:latest" >> $GITHUB_OUTPUT
          echo "tag_sha=${REGISTRY}/${ORG}/${IMAGE}:${SHORT_SHA}" >> $GITHUB_OUTPUT
          echo "short_sha=${SHORT_SHA}" >> $GITHUB_OUTPUT

      - name: 🔨 Build Image
        run: |
          buildah bud \
            --storage-driver vfs \
            -t ${{ steps.tags.outputs.tag_latest }} \
            -t ${{ steps.tags.outputs.tag_sha }} \
            -f docker-ubuntu-latest/Dockerfile \
            docker-ubuntu-latest/

      - name: 📤 Push Image → Gitea Registry
        run: |
          skopeo copy \
            --dest-tls-verify=false \
            --dest-creds "${{ secrets.REGISTRY_USER }}:${{ secrets.REGISTRY_PASSWORD }}" \
            containers-storage:${{ steps.tags.outputs.tag_latest }} \
            docker://${{ steps.tags.outputs.tag_latest }}

          skopeo copy \
            --dest-tls-verify=false \
            --dest-creds "${{ secrets.REGISTRY_USER }}:${{ secrets.REGISTRY_PASSWORD }}" \
            containers-storage:${{ steps.tags.outputs.tag_sha }} \
            docker://${{ steps.tags.outputs.tag_sha }}

      - name: 📨 Telegram Notification
        if: always()
        run: |
          curl -s -X POST \
            "https://api.telegram.org/bot${{ secrets.TELEGRAM_BOT_TOKEN }}/sendMessage" \
            -d "chat_id=${{ secrets.TELEGRAM_CHAT_ID }}" \
            -d "text=🐳 Build ubuntu-act-runner:${{ steps.tags.outputs.short_sha }} — ${{ job.status }}"