name: Build and Release FEDEO

on:
  push:
    branches: [dev, main]
  workflow_dispatch:

jobs:
  verify:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.sha }}
          fetch-depth: 0
      - uses: actions/setup-node@v4
        with:
          node-version: '22'
      - run: npm ci --ignore-scripts --no-audit --no-fund
      - name: Test release planning and recovery
        run: npm test
      - name: Check Conventional Commits
        run: npm run commits:check

  build-and-release:
    needs: verify
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.sha }}
          fetch-depth: 0
          # Prefer repository secrets; retain the existing variable during migration.
          token: ${{ secrets.RELEASE_TOKEN || secrets.CI_TOKEN || vars.CI_TOKEN }}
      - uses: actions/setup-node@v4
        with:
          node-version: '22'
      - run: npm ci --ignore-scripts --no-audit --no-fund
      - uses: docker/setup-buildx-action@v3
      - uses: docker/login-action@v3
        with:
          registry: git.federspiel.tech
          username: flfeders
          password: ${{ secrets.CI_TOKEN || vars.CI_TOKEN }}
      - name: Build all images and publish main releases
        # Gitea 1.25 ignores concurrency. ci.mjs uses an atomic Git ref lock instead.
        env:
          CI: 'true'
          FEDEO_REF: ${{ github.ref }}
          FEDEO_SHA: ${{ github.sha }}
          FEDEO_EVENT_NAME: ${{ github.event_name }}
          GITEA_TOKEN: ${{ secrets.RELEASE_TOKEN || secrets.CI_TOKEN || vars.CI_TOKEN }}
        run: npm run release:ci