name: Overseerr OIDC CI

on:
  pull_request:
    branches:
      - '*'
  push:
    branches:
      - oidc-support
  workflow_dispatch:
    inputs:
      logLevel:
        description: 'Log level'
        required: true
        default: 'warning'

env:
  # Use docker.io for Docker Hub if empty
  REGISTRY: ghcr.io
  # github.repository as <account>/<repo>
  IMAGE_NAME: ${{ github.repository }}

jobs:
  test:
    name: Lint & Test Build
    if: github.event_name == 'pull_request' || github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-22.04
    container: node:18.18-alpine
    steps:
      - name: Checkout
        uses: actions/checkout@v3
      - name: Install dependencies
        env:
          HUSKY: 0
        run: yarn
      - name: Lint
        run: yarn lint
      - name: Formatting
        run: yarn format:check
      - name: Build
        run: yarn build

  build_and_push:
    name: Build & Publish Docker Images
    if: github.ref == 'refs/heads/oidc-support' && !contains(github.event.head_commit.message, '[skip ci]') || github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout
        uses: actions/checkout@v3
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v2
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2
      - name: Log into GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Build and push
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./Dockerfile
          platforms: linux/amd64,linux/arm64,linux/arm/v7
          push: true
          build-args: |
            COMMIT_TAG=${{ github.sha }}
          tags: |
            ghcr.io/${{ env.IMAGE_NAME }}:oidc-support
            ghcr.io/${{ env.IMAGE_NAME }}:${{ github.sha }}

            
      - name: Sign the published Docker image
        if: ${{ github.event_name != 'pull_request' }}
        env:
          TAGS: ${{ steps.meta.outputs.tags }}
          DIGEST: ${{ steps.build-and-push.outputs.digest }}
        run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}