name: Build & publish image
on:
  push:
    branches: [main]
  schedule:
    - cron: '0 6 * * 1' # Mon 06:00 UTC — lands ~7h before the Monday image-update cron (13:00 UTC)
  workflow_dispatch:
    inputs:
      version:
        description: 'Upstream release version to build (e.g. 0.3.2); blank = latest release'
        required: false
        default: ''

permissions:
  contents: read
  packages: write

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Resolve upstream version
        id: ver
        run: |
          INPUT="${{ github.event.inputs.version }}"
          if [ -n "$INPUT" ]; then
            VER="$INPUT"
          else
            VER=$(curl -sf https://api.github.com/repos/freeformz/paperless-ngx-mcp/releases/latest | sed -n 's/.*"tag_name": *"v\([^"]*\)".*/\1/p')
          fi
          echo "version=$VER" >> "$GITHUB_OUTPUT"

      - name: Skip if tag already published
        id: skip
        run: |
          TAG="v${{ steps.ver.outputs.version }}"
          if docker manifest inspect "gitea.williammiceli.systems/hermes/paperless-ngx-mcp:$TAG" > /dev/null 2>&1; then
            echo "already=true" >> "$GITHUB_OUTPUT"
          else
            echo "already=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Write registry credentials
        if: steps.skip.outputs.already == 'false'
        run: |
          mkdir -p "$HOME/.docker"
          AUTH=$(printf 'Hermes:%s' "${{ secrets.REGISTRY_TOKEN }}" | base64 -w0)
          printf '{"auths":{"gitea.williammiceli.systems":{"auth":"%s"}}}\n' "$AUTH" > "$HOME/.docker/config.json"

      - name: Build and push
        if: steps.skip.outputs.already == 'false'
        run: |
          VER="${{ steps.ver.outputs.version }}"
          IMAGE="gitea.williammiceli.systems/hermes/paperless-ngx-mcp"
          docker build --build-arg PAPERLESS_VERSION="$VER" -t "$IMAGE:v$VER" -t "$IMAGE:latest" .
          docker push "$IMAGE:v$VER"
          docker push "$IMAGE:latest"