name: Push Relay Image

on:
    push:
        branches: [main]
        paths:
            - 'relay/**'
            - 'package.json'
            - 'bun.lock'
            - 'tsconfig.base.json'
            - '.github/workflows/push-relay-image.yml'
    pull_request:
        paths:
            - 'relay/**'
            - 'package.json'
            - 'bun.lock'
            - 'tsconfig.base.json'
            - '.github/workflows/push-relay-image.yml'
    workflow_dispatch:

permissions:
    contents: read

concurrency:
    group: push-relay-image-${{ github.ref }}
    cancel-in-progress: true

jobs:
    image:
        runs-on: ubuntu-latest
        permissions:
            contents: read
            packages: write
        steps:
            - uses: actions/checkout@v4
            - uses: oven-sh/setup-bun@v2
            - run: bun install --frozen-lockfile
            - run: bun run typecheck:relay
            - run: bun run test:relay

            - uses: docker/setup-qemu-action@v3
            - uses: docker/setup-buildx-action@v3
            - name: Image metadata
              id: meta
              uses: docker/metadata-action@v5
              with:
                  images: ghcr.io/${{ github.repository_owner }}/hapi-push-relay
                  tags: |
                      type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
                      type=sha,format=long
                  labels: |
                      org.opencontainers.image.title=HAPI Push Relay
                      org.opencontainers.image.description=Forwards encrypted HAPI push envelopes to APNs and FCM
                      org.opencontainers.image.licenses=AGPL-3.0-only

            - name: Log in to GHCR
              if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
              uses: docker/login-action@v3
              with:
                  registry: ghcr.io
                  username: ${{ github.actor }}
                  password: ${{ secrets.GITHUB_TOKEN }}

            - name: Build and publish
              uses: docker/build-push-action@v6
              with:
                  context: ./relay
                  platforms: linux/amd64,linux/arm64
                  push: ${{ github.event_name != 'pull_request' && github.ref == 'refs/heads/main' }}
                  tags: ${{ steps.meta.outputs.tags }}
                  labels: ${{ steps.meta.outputs.labels }}
                  cache-from: type=gha,scope=push-relay
                  cache-to: type=gha,scope=push-relay,mode=max