name: build-push
description: >
  Language-agnostic image build + push to the homelab Forgejo registry.
  The app's Dockerfile owns the toolchain. Run after actions/checkout, on
  the `host` runner label (the registry is served over HTTPS with a real
  Let's Encrypt cert, so no insecure-registry config is needed). Tags pushed:
  <short-sha> and latest.
inputs:
  app-name:
    description: Image name (registry path is <registry>/<owner>/<app-name>)
    required: true
  context:
    description: Docker build context
    required: false
    default: "."
  dockerfile:
    description: Path to Dockerfile
    required: false
    default: Dockerfile
  registry:
    description: Registry host (HTTPS, real cert; add :port only if non-443)
    required: false
    default: "git.holtlabs.xyz"
  registry-user:
    description: Registry login user (pass secrets.REGISTRY_USER)
    required: true
  registry-token:
    description: Registry token, write:package scope (pass secrets.REGISTRY_TOKEN)
    required: true
runs:
  using: composite
  steps:
    - shell: bash
      env:
        REGISTRY: ${{ inputs.registry }}
        REGISTRY_USER: ${{ inputs.registry-user }}
        REGISTRY_TOKEN: ${{ inputs.registry-token }}
      run: |
        set -euo pipefail
        TAG="${GITHUB_SHA:0:8}"
        IMAGE="$REGISTRY/$GITHUB_REPOSITORY_OWNER/${{ inputs.app-name }}"
        echo "$REGISTRY_TOKEN" | docker login "$REGISTRY" -u "$REGISTRY_USER" --password-stdin
        docker build -f "${{ inputs.dockerfile }}" \
          --build-arg GIT_SHA="$TAG" \
          -t "$IMAGE:$TAG" -t "$IMAGE:latest" "${{ inputs.context }}"
        docker push "$IMAGE:$TAG"
        docker push "$IMAGE:latest"