name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  build-and-scan:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Build prod image
        run: docker build -t lumeex:ci .

      - name: Smoke test
        run: |
          docker run --rm --entrypoint python lumeex:ci -c "
          import ast
          ast.parse(open('build.py').read())
          ast.parse(open('gallery.py').read())
          print('syntax ok')
          "

      - name: Build test image
        run: docker build --target test -t lumeex:test .

      - name: Unit tests
        run: docker run --rm lumeex:test pytest -v

      - name: Check deprecation warnings
        run: docker run --rm --entrypoint python lumeex:ci -W error::DeprecationWarning -c "import src.py.webui.webui"

      - name: Trivy critical (blocking)
        run: |
          docker run --rm \
            -e DOCKER_HOST=tcp://dockerhost:2375 --add-host=dockerhost:host-gateway \
            -v /var/run/docker.sock:/var/run/docker.sock \
            aquasec/trivy image --exit-code 1 --severity CRITICAL lumeex:ci

      - name: Trivy high (informative)
        run: |
          docker run --rm \
            -e DOCKER_HOST=tcp://dockerhost:2375 --add-host=dockerhost:host-gateway \
            -v /var/run/docker.sock:/var/run/docker.sock \
            aquasec/trivy image --exit-code 0 --severity HIGH lumeex:ci

      - name: Publish tagged image
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        env:
          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
          CI_PUSH_TOKEN: ${{ secrets.CI_PUSH_TOKEN }}
          GITEA_URL: https://git.djeex.fr
          IMAGE: git.djeex.fr/djeex/lumeex
        run: |
          set -e

          # Only republish when a container-relevant file actually changed
          BEFORE="${{ github.event.before }}"
          if [ -z "$BEFORE" ] || [ "$BEFORE" = "0000000000000000000000000000000000000000" ]; then
            BEFORE="HEAD~1"
          fi
          CHANGED=$(git diff --name-only "$BEFORE" "${{ github.sha }}" -- \
            Dockerfile requirements.txt VERSION build.py gallery.py \
            src/ config/ docker/.sh/entrypoint.sh || true)

          if [ -z "$CHANGED" ]; then
            echo "No container-relevant changes, skipping publish."
            exit 0
          fi

          VERSION_BUMPED=false
          if ! echo "$CHANGED" | grep -qx "VERSION"; then
            CURRENT_VERSION=$(cat VERSION)
            MAJOR=$(echo "$CURRENT_VERSION" | cut -d. -f1)
            MINOR=$(echo "$CURRENT_VERSION" | cut -d. -f2)
            PATCH=$(echo "$CURRENT_VERSION" | cut -d. -f3)
            NEW_VERSION="$MAJOR.$MINOR.$((PATCH + 1))"
            echo "$NEW_VERSION" > VERSION

            git config user.name "gitea-ci"
            git config user.email "ci@git.djeex.fr"
            git remote set-url origin "https://gitea-ci:${CI_PUSH_TOKEN}@git.djeex.fr/Djeex/lumeex.git"
            git add VERSION
            git commit -m "chore: bump version to $NEW_VERSION [skip ci]"
            git push origin HEAD:main
            git config --unset-all "http.https://git.djeex.fr/Djeex/lumeex.git/.extraheader" || true
            VERSION_BUMPED=true
          fi

          FULL_VERSION=$(cat VERSION)
          MAJOR_MINOR=$(echo "$FULL_VERSION" | cut -d. -f1,2)

          echo "$REGISTRY_TOKEN" | docker login git.djeex.fr -u Djeex --password-stdin

          docker tag lumeex:ci "$IMAGE:latest"
          docker tag lumeex:ci "$IMAGE:$MAJOR_MINOR"
          docker tag lumeex:ci "$IMAGE:$FULL_VERSION"
          docker push "$IMAGE:latest"
          docker push "$IMAGE:$MAJOR_MINOR"
          docker push "$IMAGE:$FULL_VERSION"

          # Categorize the changelog from the merged PR's labels, if any
          PR_NUMBER=$(git log -1 --format=%B "${{ github.sha }}" | grep -oE '#[0-9]+' | head -1 | tr -d '#' || true)
          CATEGORY="🔧 Maintenance"
          PR_LINK=""
          if [ -n "$PR_NUMBER" ]; then
            PR_LINK="https://git.djeex.fr/Djeex/lumeex/pulls/$PR_NUMBER"
            LABELS=$(curl -s -H "Authorization: token $CI_PUSH_TOKEN" \
              "$GITEA_URL/api/v1/repos/Djeex/lumeex/issues/$PR_NUMBER/labels" | jq -r '.[].name' || true)
            if echo "$LABELS" | grep -qx "bug"; then
              CATEGORY="⚠️ Hotfix"
            elif echo "$LABELS" | grep -qx "major"; then
              CATEGORY="💥 Breaking change"
            elif echo "$LABELS" | grep -qx "minor"; then
              CATEGORY="✨ Update"
            fi
          fi

          COMMIT_LINK="https://git.djeex.fr/Djeex/lumeex/commit/${{ github.sha }}"
          BODY=$(printf '**%s**\n\nCommit: %s' "$CATEGORY" "$COMMIT_LINK")
          if [ -n "$PR_LINK" ]; then
            BODY=$(printf '%s\nPR: %s' "$BODY" "$PR_LINK")
          fi

          jq -n \
            --arg tag "$FULL_VERSION" \
            --arg name "$FULL_VERSION" \
            --arg body "$BODY" \
            '{tag_name: $tag, name: $name, body: $body}' | \
          curl -s -X POST \
            -H "Authorization: token $CI_PUSH_TOKEN" \
            -H "Content-Type: application/json" \
            -d @- \
            "$GITEA_URL/api/v1/repos/Djeex/lumeex/releases"