name: Docker Build & Publish UI

on:
  push:
    branches: [ prod, dev ]

env:
  REGISTRY: gitea.biz360.me
  IMAGE_NAME: ${{ github.repository }}
  PROJECT_SECRET_KEY: "MASTERADMINUI"
  # Target the base environment file directly
  ENV_FILE_PATH: "src/environments/environment.ts"

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Determine Environment
        id: env_config
        run: |
          if [[ "${GITHUB_REF##*/}" == "dev" ]]; then
            echo "INFISICAL_ENV=dev" >> $GITHUB_OUTPUT
          elif [[ "${GITHUB_REF##*/}" == "prod" ]]; then
            echo "INFISICAL_ENV=prod" >> $GITHUB_OUTPUT
          fi

      - name: Fetch secrets from Infisical
        uses: Infisical/secrets-action@v1.0.9
        with:
          client-id: ${{ secrets.INFISICAL_CLIENT_ID }}
          client-secret: ${{ secrets.INFISICAL_CLIENT_SECRET }}
          env-slug: ${{ steps.env_config.outputs.INFISICAL_ENV }}
          project-slug: "syscom-xpq-0"
          domain: "https://infisical.biz360.me/"
          # export-type: "file"
          # file-output-path: "/infisical.env"

      # - name: Brute-force overwrite environment.ts
      #   run: |
      #     source infisical.env

      #     # Forcefully overwrite the file the developers are importing
      #     echo "${!PROJECT_SECRET_KEY}" > "$ENV_FILE_PATH"

      #     # Clean up
      #     rm -f infisical.env

      - name: Brute-force overwrite environment.ts
        run: |
          # Because the secret is now a native environment variable, we can write it directly.
          # The double quotes around the indirect expansion preserve all newlines and internal single quotes!
          echo "${!PROJECT_SECRET_KEY}" > "$ENV_FILE_PATH"

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to Gitea Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.REGISTRY_TOKEN }}

      - name: Docker metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=raw,value=dev-{{date 'YYYYMMDDTHHmm'}},enable=${{ github.ref == 'refs/heads/dev' }}
            type=raw,value=prod-{{date 'YYYYMMDDTHHmm'}},enable=${{ github.ref == 'refs/heads/prod' }}

      - name: Build and push Docker image
        uses: docker/build-push-action@v5
        with:
          context: .
          file: Dockerfile
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      # Optional: Revert the file so the runner stays completely clean
      - name: Clean up modified workspace
        if: always()
        run: git checkout -- "$ENV_FILE_PATH"