name: CI

on:
  push:
  pull_request:

jobs:
  checks:
    name: Static checks
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 22

      - name: Enable corepack
        run: corepack enable

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Lint
        run: pnpm lint

      # `next build` runs its own full TypeScript check as part of the
      # build - a separate `tsc --noEmit` here would fail on a clean
      # checkout anyway, since it needs .next/types (generated by this
      # same build) for Next's own ambient types like LayoutProps.
      - name: Build
        run: pnpm build

  publish:
    name: Build and push image
    if: startsWith(github.ref, 'refs/tags/')
    needs: checks
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      # PACKAGE_TOKEN is provided by the runner environment, not a repo
      # secret - it's already present in the job's shell environment.
      - name: Log in to the Gitea container registry
        run: echo "$PACKAGE_TOKEN" | docker login dev.pivoine.art -u ${{ github.repository_owner }} --password-stdin

      - name: Build image
        run: |
          docker build \
            -t dev.pivoine.art/${{ github.repository }}:latest \
            -t dev.pivoine.art/${{ github.repository }}:${{ github.ref_name }} \
            .

      - name: Push image
        run: |
          docker push dev.pivoine.art/${{ github.repository }}:latest
          docker push dev.pivoine.art/${{ github.repository }}:${{ github.ref_name }}

      - name: Log out
        if: always()
        run: docker logout dev.pivoine.art