name: Build and Push Docker Images

on:
  push:
    branches: [main]
    paths:
      - "ci/**"

env:
  HARBOR_REGISTRY: kcr.kollect.biz
  HARBOR_PROJECT: kollect-tools

jobs:
  # Detect which images changed
  detect-changes:
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
      has_changes: ${{ steps.set-matrix.outputs.has_changes }}
    steps:
      - uses: https://github.com/actions/checkout@v6
        with:
          fetch-depth: 2

      - name: Detect changed images
        id: set-matrix
        run: |
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            # On manual trigger, build all images
            IMAGES=$(find ci -mindepth 1 -maxdepth 1 -type d -exec basename {} \; | jq -R -s -c 'split("\n") | map(select(length > 0))')
          else
            # On push, only build changed images
            IMAGES=$(git diff --name-only HEAD~1 HEAD -- ci/ \
              | cut -d'/' -f2 | sort -u \
              | jq -R -s -c 'split("\n") | map(select(length > 0))')
          fi

          if [ "$IMAGES" = "[]" ] || [ -z "$IMAGES" ]; then
            echo "has_changes=false" >> "$GITHUB_OUTPUT"
            echo "matrix={\"image\":[]}" >> "$GITHUB_OUTPUT"
          else
            echo "has_changes=true" >> "$GITHUB_OUTPUT"
            echo "matrix={\"image\":$IMAGES}" >> "$GITHUB_OUTPUT"
          fi

  build-and-push:
    needs: detect-changes
    if: needs.detect-changes.outputs.has_changes == 'true'
    runs-on: ubuntu-latest
    strategy:
      matrix: ${{ fromJson(needs.detect-changes.outputs.matrix) }}
    steps:
      - uses: https://github.com/actions/checkout@v6
      - name: Set image metadata
        id: meta
        run: |
          IMAGE_NAME="${{ env.HARBOR_REGISTRY }}/${{ env.HARBOR_PROJECT }}/${{ matrix.image }}"
          SHORT_SHA=$(echo "${{ github.sha }}" | cut -c1-7)
          TIMESTAMP=$(date +%Y%m%d)

          echo "image_name=${IMAGE_NAME}" >> "$GITHUB_OUTPUT"
          echo "tag_sha=${IMAGE_NAME}:${SHORT_SHA}" >> "$GITHUB_OUTPUT"
          echo "tag_date=${IMAGE_NAME}:${TIMESTAMP}" >> "$GITHUB_OUTPUT"
          echo "tag_latest=${IMAGE_NAME}:latest" >> "$GITHUB_OUTPUT"

      - name: Login to Harbor
        # Pass secrets via env (not ${{ }} inlining) so shell quoting can't
        # mangle them — e.g. a literal `$` in the robot username would be
        # expanded by bash if inlined inside double quotes. printf (not echo)
        # avoids appending a newline to the password sent to --password-stdin.
        env:
          HARBOR_USERNAME: ${{ secrets.HARBOR_USERNAME }}
          HARBOR_PASSWORD: ${{ secrets.HARBOR_PASSWORD }}
        run: |
          printf '%s' "$HARBOR_PASSWORD" \
            | docker login "$HARBOR_REGISTRY" \
                -u "$HARBOR_USERNAME" \
                --password-stdin

      - name: Build image
        env:
          DOCKER_BUILDKIT: "1"
        run: |
          # Pull the previous :latest to use as a layer cache source.
          # First builds (no prior image) fail this pull — that's fine.
          docker pull "${{ steps.meta.outputs.tag_latest }}" || true

          # On schedule / manual dispatch, bust the OWASP NVD layer so the
          # weekly rebuild actually refreshes the NVD database. Push builds
          # leave it empty so unchanged layers stay cached.
          NVD_REFRESH=""
          if [ "${{ github.event_name }}" = "schedule" ] || \
             [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            NVD_REFRESH="$(date +%Y%m%d)"
          fi

          docker build \
            --build-arg BUILDKIT_INLINE_CACHE=1 \
            --build-arg NVD_REFRESH="${NVD_REFRESH}" \
            --cache-from "${{ steps.meta.outputs.tag_latest }}" \
            --label "org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}" \
            --label "org.opencontainers.image.revision=${{ github.sha }}" \
            -t "${{ steps.meta.outputs.tag_sha }}" \
            -t "${{ steps.meta.outputs.tag_date }}" \
            -t "${{ steps.meta.outputs.tag_latest }}" \
            "ci/${{ matrix.image }}/"

      - name: Push image
        run: |
          docker push "${{ steps.meta.outputs.tag_sha }}"
          docker push "${{ steps.meta.outputs.tag_date }}"
          docker push "${{ steps.meta.outputs.tag_latest }}"

      - name: Summary
        run: |
          echo "### Pushed image" >> "$GITHUB_STEP_SUMMARY"
          echo "" >> "$GITHUB_STEP_SUMMARY"
          echo "| Tag | Value |" >> "$GITHUB_STEP_SUMMARY"
          echo "|-----|-------|" >> "$GITHUB_STEP_SUMMARY"
          echo "| latest | \`${{ steps.meta.outputs.tag_latest }}\` |" >> "$GITHUB_STEP_SUMMARY"
          echo "| sha | \`${{ steps.meta.outputs.tag_sha }}\` |" >> "$GITHUB_STEP_SUMMARY"
          echo "| date | \`${{ steps.meta.outputs.tag_date }}\` |" >> "$GITHUB_STEP_SUMMARY"