name: Build ci-python image

# Baut das ci-python-Image und pusht es in die Gitea-Container-Registry.
# Tags: :latest (mitlaufend) + :<sha> (unveränderlich, zum Pinnen in Workflows).
#
# Voraussetzungen im Runner:
#   - Docker verfügbar (Socket oder DinD) — Image-Bau braucht einen Docker-Daemon.
#   - Secrets: REGISTRY_USER (Gitea-User) + REGISTRY_TOKEN (PAT, Scope package:write).

on:
  push:
    branches: [main]
    paths:
      - 'python/Dockerfile'
      - '.gitea/workflows/build-ci-python.yml'
  schedule:
    - cron: '0 3 * * 1'   # wöchentlicher Rebuild für Basis-Sicherheitsupdates
  workflow_dispatch:

env:
  REGISTRY: gitea.inmedias.it
  IMAGE: sko/ci-python

jobs:
  build:
    runs-on: ubuntu-latest
    # Nur dieser Build-Job bekommt Docker-Zugriff: der Host-Socket wird in den
    # Job-Container gemountet (build-push-action redet damit mit dem Host-Daemon).
    # Der Runner muss /var/run/docker.sock in valid_volumes erlauben (deploy-CICD,
    # ansible/setup-cicd-runner.yml, Issue #11).
    container:
      image: catthehacker/ubuntu:act-22.04
      options: -v /var/run/docker.sock:/var/run/docker.sock
    steps:
      - uses: actions/checkout@v4

      - uses: docker/setup-buildx-action@v3

      - name: Login to Gitea registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ secrets.REGISTRY_USER }}
          password: ${{ secrets.REGISTRY_TOKEN }}

      - name: Build & push
        uses: docker/build-push-action@v6
        with:
          context: python
          push: true
          tags: |
            ${{ env.REGISTRY }}/${{ env.IMAGE }}:latest
            ${{ env.REGISTRY }}/${{ env.IMAGE }}:${{ github.sha }}
          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE }}:buildcache
          cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE }}:buildcache,mode=max