when:
  - event: tag
    ref: refs/tags/v*

steps:
  # Same publish step as the PR pipeline: clone pinned upstream + dotnet publish.
  - name: publish
    image: mcr.microsoft.com/dotnet/sdk:9.0
    commands:
      - |
        REF=$$(cat UPSTREAM_REF)
        git clone https://git.unkin.net/unkin/jellyfin-ha-src.git src
        git -C src checkout "$$REF"
        dotnet publish src/Jellyfin.Server/Jellyfin.Server.csproj \
          -c Release -r linux-x64 --self-contained false -o ./publish-output
    backend_options:
      kubernetes:
        serviceAccountName: default
        resources:
          requests:
            memory: 2Gi
            cpu: 2
          limits:
            memory: 6Gi
            cpu: 4

  # Build the runtime image and push it to the artifactapi local docker registry.
  # The plugin image bakes artifactapi's internal (Vault) CA at
  # /etc/docker/certs.d/<registry>/ca.crt; buildkit_config points the buildx
  # docker-container builder at that in-image CA. buildkitd runs in its own
  # container and performs the push, so it needs the CA via --config even though
  # the plugin image already trusts it — buildx copies the referenced file in.
  - name: docker
    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:latest
    settings:
      registry: artifactapi.k8s.syd1.au.unkin.net
      repo: artifactapi.k8s.syd1.au.unkin.net/docker-internal/jellyfin-ha
      dockerfile: Dockerfile.runtime
      buildkit_config: |
        [registry."artifactapi.k8s.syd1.au.unkin.net"]
          ca = ["/etc/docker/certs.d/artifactapi.k8s.syd1.au.unkin.net/ca.crt"]
      tags:
        - ${CI_COMMIT_TAG}
        - latest
    depends_on: [publish]
    backend_options:
      kubernetes:
        serviceAccountName: default
        resources:
          requests:
            memory: 1Gi
            cpu: 1
          limits:
            memory: 4Gi
            cpu: 2