name: Construir y publicar imagen de prueba

on:
  workflow_dispatch:

jobs:
  publicar:
    runs-on: gitea-ci
    timeout-minutes: 15

    container:
      image: moby/buildkit:v0.34.0-rootless
      options: >-
        --user=1000:1000
        --security-opt seccomp=unconfined
        --security-opt apparmor=gitea-buildkit-rootless
        --security-opt systempaths=unconfined

    steps:
      - name: Construir y publicar en Gitea
        shell: sh
        working-directory: /tmp
        env:
          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
          COMMIT_SHA: ${{ gitea.sha }}
          BUILDKITD_FLAGS: >-
            --oci-worker-snapshotter=native
            --oci-worker-no-process-sandbox
        run: |
          set -eu
          umask 077

          : "${REGISTRY_USER:?Falta REGISTRY_USER}"
          : "${REGISTRY_TOKEN:?Falta REGISTRY_TOKEN}"
          : "${COMMIT_SHA:?Falta COMMIT_SHA}"

          WORK=$(mktemp -d /tmp/prueba-registry.XXXXXX)
          trap 'rm -rf "$WORK"' EXIT

          mkdir "$WORK/context" "$WORK/auth"
          export DOCKER_CONFIG="$WORK/auth"

          AUTH=$(printf '%s:%s' "$REGISTRY_USER" "$REGISTRY_TOKEN" |
            base64 | tr -d '\n')

          printf '{"auths":{"git.becodes.com.ar":{"auth":"%s"}}}\n' \
            "$AUTH" > "$DOCKER_CONFIG/config.json"

          unset AUTH REGISTRY_TOKEN REGISTRY_USER

          cat > "$WORK/context/Dockerfile" <<'EOF'
          FROM alpine:3.23
          RUN printf 'Imagen publicada desde Gitea Actions\n' > /prueba.txt \
              && test -s /prueba.txt
          CMD ["cat", "/prueba.txt"]
          EOF

          IMAGE="git.becodes.com.ar/becodes-team/prueba-infra:ci-${COMMIT_SHA}"

          buildctl-daemonless.sh build \
            --frontend dockerfile.v0 \
            --local context="$WORK/context" \
            --local dockerfile="$WORK/context" \
            --opt platform=linux/amd64 \
            --output "type=image,name=$IMAGE,push=true"

          echo "Imagen publicada: $IMAGE"