name: Publish public images

# Push the three node images to a PUBLIC registry on a version tag, so a fresh
# Pi can `docker pull` them without a Gitea login (git.vpn.cusano.net is now
# behind REQUIRE_SIGNIN_VIEW — see INCIDENT-2026-09-06). Source + the private
# registry stay walled; only the built node images go public.
#
# ── DISABLED ────────────────────────────────────────────────────────────────
# The job is gated on `vars.NODE_PUBLIC_PUBLISH == 'true'`. Until that repo
# variable is set the workflow triggers on tags but the job is skipped, so
# this file is wired and inert. We're still building the core; flip it on when
# self-serve node install is actually needed.
#
# To enable:
#   1. Repo → Settings → Actions → Variables:
#        NODE_PUBLIC_PUBLISH = true
#        PUBLIC_REGISTRY     = ghcr.io            (or docker.io)
#        PUBLIC_NAMESPACE    = <org-or-user>      (images land at <ns>/drb-<name>)
#   2. Repo → Settings → Actions → Secrets:
#        PUBLIC_REGISTRY_USER   = <push user>
#        PUBLIC_REGISTRY_TOKEN  = <push token / PAT with write:packages>
#   3. Re-push a tag (or run this workflow via workflow_dispatch).
# ---------------------------------------------------------------------------

on:
  workflow_dispatch:
  push:
    tags:
      - "v*"

concurrency:
  group: publish-public-${{ github.ref }}
  cancel-in-progress: false

jobs:
  publish:
    # Inert until the repo variable is set. Do NOT convert this to `if: false`
    # — the variable is the switch, no code change needed to go live.
    if: ${{ vars.NODE_PUBLIC_PUBLISH == 'true' }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: edge-node
            context: ./drb-edge-node
            file: ./drb-edge-node/Dockerfile
            cache_name: edge-node
          - name: icecast
            context: ./icecast
            file: ./icecast/Dockerfile
            cache_name: icecast
          - name: op25-client
            context: ./op25-container
            file: ./op25-container/Dockerfile
            cache_name: op25-client
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0   # need tags for `git describe`

      - uses: docker/setup-qemu-action@v3
      - uses: docker/setup-buildx-action@v3
        with:
          config-inline: |
            [registry."git.vpn.cusano.net"]
              http = false
              insecure = false

      # Private Gitea registry — read only, to reuse the existing build cache
      # (keeps the op25 image off a ~1h from-scratch compile).
      - uses: docker/login-action@v3
        with:
          registry: git.vpn.cusano.net
          username: ${{ gitea.actor }}
          password: ${{ secrets.BUILD_TOKEN }}

      # Public registry — where the images are pushed.
      - uses: docker/login-action@v3
        with:
          registry: ${{ vars.PUBLIC_REGISTRY }}
          username: ${{ secrets.PUBLIC_REGISTRY_USER }}
          password: ${{ secrets.PUBLIC_REGISTRY_TOKEN }}

      - name: Version
        id: meta
        run: |
          echo "REPO_NAME=$(echo ${GITHUB_REPOSITORY} | awk -F'/' '{print $2}')" >> $GITHUB_OUTPUT
          echo "VERSION=$(git describe --tags --always | sed 's/^v//')" >> $GITHUB_OUTPUT

      - uses: docker/build-push-action@v6
        with:
          context: ${{ matrix.context }}
          file: ${{ matrix.file }}
          platforms: linux/arm64
          push: true
          tags: |
            ${{ vars.PUBLIC_REGISTRY }}/${{ vars.PUBLIC_NAMESPACE }}/drb-${{ matrix.name }}:${{ steps.meta.outputs.VERSION }}
            ${{ vars.PUBLIC_REGISTRY }}/${{ vars.PUBLIC_NAMESPACE }}/drb-${{ matrix.name }}:latest
          cache-from: type=registry,ref=git.vpn.cusano.net/${{ vars.DOCKER_ORG }}/${{ steps.meta.outputs.REPO_NAME }}/${{ matrix.cache_name }}:buildcache