# Build the images the cluster runs (weave-kube, weave-npc) and push them to
# this Gitea's container registry. CI stops here: rolling them out is the
# CD side's job, not this workflow's.
#
# Tags are the full commit SHA, so a tag never moves: rebuilding a commit
# pushes the same name again instead of changing what an existing name means.
# linux/amd64 only for now (every node is amd64).
name: images

on:
  push:
    paths-ignore:
      - "website/**"
      - "docs/**"
      - "**.md"
  workflow_dispatch:

# The job token can't log in to the registry (no package scope there), so
# the push uses the reweave-ci bot's token from the org secret REGISTRY_TOKEN.
permissions:
  contents: read

jobs:
  images:
    runs-on: ubuntu-latest
    env:
      REGISTRY: git.levk.dev
      IMAGE_PREFIX: git.levk.dev/reweave
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0 # tags, for the version string
          submodules: true # tools/ (weaveworks/build-tools): make all builds tools/runner

      - name: Log in to the registry
        run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login "$REGISTRY" -u reweave-ci --password-stdin

      - name: Build and push (linux/amd64)
        run: |
          set -eu
          sha=$(git rev-parse HEAD)
          version=$(git describe --tags --always | sed 's/^v//')
          for pair in weavekubeimage:weave-kube weavenpcimage:weave-npc; do
            target=${pair%%:*}
            image="$IMAGE_PREFIX/${pair#*:}:$sha"
            docker buildx build --push --progress=plain \
              --platform=linux/amd64 \
              --target="$target" \
              --build-arg=WEAVE_VERSION="$version" \
              --build-arg=revision="$sha" \
              --build-arg=imageversion="$version" \
              -f reweave/build/Dockerfile \
              -t "$image" \
              .
            echo "pushed $image"
          done