name: HA Build & Push to ECR

on:
  push:
    branches:
      - master
      - main
      - "feat/ha-*"
      - "feat/phase*"
      - "copilot/*"
  # pull_request intentionally removed: this workflow runs on self-hosted k3s
  # runners. Allowing pull_request events from a public repo would let any
  # internet user execute arbitrary code inside the cluster network.
  # CI build feedback on PRs is provided by ci-tests.yml (GitHub-hosted runners).

# Cancel in-progress runs when a new push arrives on the same branch.
concurrency:
  group: ha-build-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build-and-push:
    runs-on: [self-hosted, k3s, linux, amd64]

    permissions:
      contents: read

    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ secrets.AWS_REGION }}

      - name: Login to Amazon ECR
        id: ecr-login
        uses: aws-actions/amazon-ecr-login@062b18b96a7aff071d4dc91bc00c4c1a7945b076 # v2.0.1

      - name: Set image metadata
        id: meta
        run: |
          REPO="${{ steps.ecr-login.outputs.registry }}/${{ secrets.ECR_REPOSITORY }}"
          SHORT_SHA="${GITHUB_SHA::7}"
          echo "image_repo=${REPO}" >> "$GITHUB_OUTPUT"
          echo "short_sha=${SHORT_SHA}"  >> "$GITHUB_OUTPUT"

      - name: Install .NET SDK
        # Build on the runner host filesystem (native I/O) to avoid DinD
        # overlay-on-overlay throttling which makes dotnet publish ~20x slower.
        run: |
          DOTNET_INSTALL_DIR="$HOME/.dotnet"
          mkdir -p "$DOTNET_INSTALL_DIR"
          if ! "$DOTNET_INSTALL_DIR/dotnet" --version 2>/dev/null | grep -q "^10\\."; then
            curl -fsSL https://dot.net/v1/dotnet-install.sh | bash /dev/stdin --channel 10.0 --install-dir "$DOTNET_INSTALL_DIR"
          fi
          echo "DOTNET_ROOT=$DOTNET_INSTALL_DIR" >> "$GITHUB_ENV"
          echo "PATH=$DOTNET_INSTALL_DIR:$PATH" >> "$GITHUB_ENV"

      - name: Restore NuGet packages
        run: |
          export PATH="$HOME/.dotnet:$PATH"
          dotnet restore Jellyfin.Server/Jellyfin.Server.csproj --runtime linux-x64

      - name: Publish Jellyfin server
        run: |
          export PATH="$HOME/.dotnet:$PATH"
          dotnet publish Jellyfin.Server/Jellyfin.Server.csproj \
            --configuration Release \
            --runtime linux-x64 \
            --self-contained false \
            --no-restore \
            -p:TreatWarningsAsErrors=false \
            --output ./publish-output

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build and push image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: Dockerfile.runtime
          platforms: linux/amd64
          # Only push the image on direct branch pushes, not on pull_request events.
          push: ${{ github.event_name == 'push' }}
          provenance: false
          tags: |
            ${{ steps.meta.outputs.image_repo }}:${{ steps.meta.outputs.short_sha }}
            ${{ steps.meta.outputs.image_repo }}:latest