name: build-and-push
on:
  push:
    branches: [main]
  workflow_dispatch:
env:
  IMAGE: git.doc-gen.eu/wsfcqyxbu1/wkd      # lowercase namespace!
jobs:
  build:
    runs-on: docker-builder
    steps:
      - uses: actions/checkout@v4
      - name: Login bij Forgejo registry
        run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login git.doc-gen.eu -u wSFcQyxBu1 --password-stdin
      - name: Build image (bouwt de hu/-boom met gpg-wks-client; faalt bij een foute/privé-sleutel)
        run: docker build --pull -t "${IMAGE}:latest" -t "${IMAGE}:${{ github.sha }}" .
      - name: Controle in de gebouwde image (policy per domein aanwezig)
        run: |
          docker run --rm "${IMAGE}:latest" sh -c 'set -e; cd /usr/share/nginx/html/.well-known/openpgpkey; for d in */; do test -f "$d/policy"; done; find . -type f | sort'
      - name: Push image
        run: |
          docker push "${IMAGE}:latest"
          docker push "${IMAGE}:${{ github.sha }}"
      - name: ntfy bij falen
        if: failure()
        run: |
          curl -s -o /dev/null -H "Authorization: Bearer ${{ secrets.NTFY_TOKEN }}" \
            -H "Title: WKD CI-build FAALDE" -H "Priority: high" -H "Tags: rotating_light" \
            -d "build.yml van wSFcQyxBu1/wkd faalde (run ${{ github.run_number }}, sha ${{ github.sha }})." \
            https://ntfy.3838.eu/docgen-backup || true