# Builds the CI runner image (ci/runner-image/Dockerfile, #120) and publishes it to this
# repository's package registry, tagged with the commit it was built from:
#
#   gitea.starshipos-f18.org/rajames/lithosananke-runner:<commit>
#
# The workflows name that tag as their container. A new tag -- after a change to init in the
# Makefile, or to the Dockerfile -- reaches them by a pull request, which acceptance runs on it.
#
# Needs the runner to give jobs its Docker daemon (act_runner config.yaml, container.docker_host:
# automount), and a secret PACKAGES_TOKEN -- a token with write:package -- unless the Actions
# token may publish packages here.
name: Runner image

on:
  push:
    branches: [master]
    paths: ['ci/runner-image/**', 'Makefile']
  workflow_dispatch:

concurrency:
  group: qemu                     # every workflow shares this one group (Captain Bob, 2026-11-07: a
  cancel-in-progress: false       # runner-image rebuild blocks other jobs, always): one run at a time

jobs:
  image:
    name: Build and publish the runner image
    runs-on: ubuntu-latest
    container:
      image: gitea/runner-images:ubuntu-24.04-v26.11.03
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v4
        with:
          lfs: false

      - name: Docker is reachable
        run: |
          docker info >/dev/null 2>&1 || {
            echo "::error::No Docker daemon in this job. Set container.docker_host: automount in the runner's config.yaml, or build the image on the server: see this file's header."
            exit 1; }

      - name: Build and publish
        env:
          TOKEN: ${{ secrets.PACKAGES_TOKEN || secrets.GITEA_TOKEN }}
        run: |
          set -e
          img=gitea.starshipos-f18.org/rajames/lithosananke-runner
          tag=$(git rev-parse --short=12 HEAD)
          ctx=$(mktemp -d)                                  # not the repository: 7 GB of context
          cp -r Makefile boards ci/runner-image/Dockerfile "$ctx/"
          tok=$(mktemp); printf '%s' "$TOKEN" > "$tok"          # the HOL-Library heap's download (Dockerfile)
          docker build --secret id=pkgtoken,src="$tok" -t "$img:$tag" "$ctx"
          rm -f "$tok"
          echo "$TOKEN" | docker login gitea.starshipos-f18.org -u rajames --password-stdin
          docker push "$img:$tag"
          echo "Published $img:$tag"