---
# CI job images. .gitea/workflows/ci-images.yml builds files/Containerfile.*
# and pushes them to the Gitea registry; this role only logs the runner in and
# makes sure the images are present, so a plain deploy never waits on a build.
#
# Set gitea_ci_build_local=true to build and push from here instead -- see the
# comment on that variable in defaults/main.yml.
- name: create gitea-runner registry auth directory
  become: true
  become_user: "{{ gitea_runner_user }}"
  ansible.builtin.file:
    path: "{{ gitea_ci_registry_authfile | dirname }}"
    state: directory
    mode: "0700"
  tags: gitea-actions

# Docker-format path on purpose: act_runner reads ~/.docker/config.json to
# authenticate the job-image pull it does when a label's image is missing, and
# podman falls back to the same file. One login covers both.
- name: log gitea-runner in to the Gitea container registry
  become: true
  become_user: "{{ gitea_runner_user }}"
  containers.podman.podman_login:
    registry: "{{ gitea_ci_registry }}"
    username: "{{ gitea_registry_username }}"
    password: "{{ gitea_registry_token }}"
    authfile: "{{ gitea_ci_registry_authfile }}"
  environment:
    XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
  no_log: true
  tags: gitea-actions

- name: pull CI images from the registry
  become: true
  become_user: "{{ gitea_runner_user }}"
  containers.podman.podman_image:
    name: "{{ item.image }}"
    auth_file: "{{ gitea_ci_registry_authfile }}"
  environment:
    XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
  loop: "{{ gitea_ci_images }}"
  loop_control:
    label: "{{ item.image }}"
  when: not (gitea_ci_build_local | bool)
  tags: gitea-actions

# --- local build fallback (gitea_ci_build_local=true) ------------------------
# Only reached when seeding a new namespace or when CI cannot build for us.
- name: create CI image build directory
  become: true
  become_user: "{{ gitea_runner_user }}"
  ansible.builtin.file:
    path: "{{ gitea_runner_home }}/ci-images"
    state: directory
    mode: "0755"
  when: gitea_ci_build_local | bool
  tags: gitea-actions

# copy, not template: these are plain Containerfiles that CI builds verbatim.
# Versions come in as --build-arg from the same defaults/main.yml the workflow
# reads, so neither builder can drift from the other.
- name: stage CI Containerfiles
  become: true
  become_user: "{{ gitea_runner_user }}"
  ansible.builtin.copy:
    src: "{{ item.containerfile }}"
    dest: "{{ gitea_runner_home }}/ci-images/{{ item.containerfile }}"
    mode: "0644"
  loop: "{{ gitea_ci_images }}"
  loop_control:
    label: "{{ item.containerfile }}"
  when: gitea_ci_build_local | bool
  tags: gitea-actions

- name: build and push CI images
  become: true
  become_user: "{{ gitea_runner_user }}"
  containers.podman.podman_image:
    name: "{{ item.image }}"
    path: "{{ gitea_runner_home }}/ci-images"
    build:
      file: "{{ gitea_runner_home }}/ci-images/{{ item.containerfile }}"
      extra_args: "{{ item.build_args }}"
    force: true
    push: true
    auth_file: "{{ gitea_ci_registry_authfile }}"
  environment:
    XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
  loop: "{{ gitea_ci_images }}"
  loop_control:
    label: "{{ item.image }}"
  when: gitea_ci_build_local | bool
  tags: gitea-actions