name: build-and-publish
on:
  push:
    branches: [main]
  # Lets `rebuild-all-apps.sh` force a rebuild (e.g. to roll out an urgent platform fix immediately
  # instead of waiting for a Renovate bump PR).
  workflow_dispatch:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Log in to the Gitea container registry
        run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login git.thebennett.net -u "${{ secrets.REGISTRY_USER }}" --password-stdin

      # The platform is now referenced by an immutable RELEASE version, so a cached maven layer can't
      # silently hold an old build — layer caching is safe again (and much faster).
      - name: Build image
        env:
          DOCKER_BUILDKIT: "1"
          MAVEN_USER: ${{ secrets.REGISTRY_USER }}
          MAVEN_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
        run: |
          docker build \
            --secret id=maven_user,env=MAVEN_USER \
            --secret id=maven_token,env=MAVEN_TOKEN \
            --build-arg GIT_SHA=${{ github.sha }} \
            -t git.thebennett.net/reformedwitness/confessions-of-grace:latest \
            -t git.thebennett.net/reformedwitness/confessions-of-grace:${{ github.sha }} .

      - name: Scan image (Trivy)
        run: |
          docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
            aquasec/trivy:latest image --scanners vuln --severity HIGH,CRITICAL --ignore-unfixed --no-progress \
            git.thebennett.net/reformedwitness/confessions-of-grace:latest || true
          docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
            aquasec/trivy:latest image --scanners vuln --severity HIGH,CRITICAL --ignore-unfixed \
            --pkg-types library --exit-code 1 --no-progress \
            git.thebennett.net/reformedwitness/confessions-of-grace:latest

      - name: Push image
        run: |
          docker push git.thebennett.net/reformedwitness/confessions-of-grace:latest
          docker push git.thebennett.net/reformedwitness/confessions-of-grace:${{ github.sha }}