name: Build and Push to ACR

on:
  push:
    branches: [ main ]
  release:
    types: [ published ]
  workflow_dispatch:
    inputs:
      image_tag:
        description: "Tag to push (leave empty to use 'latest')"
        required: false
        default: ""

jobs:
  docker:
    runs-on: [buildx]
    steps:
      - name: Checkout
        uses: actions/checkout@v3

      - name: Resolve TAG
        id: meta
        env:
          INPUT_TAG: ${{ github.event.inputs.image_tag || '' }}
        run: |
          set -euo pipefail

          # 仅两级：手动输入 > latest
          TAG="${INPUT_TAG:-}"
          if [ -z "$TAG" ]; then TAG="latest"; fi

          # 规范化（可留可去，但推荐保留，防止手滑输非法字符）
          TAG="$(printf '%s' "$TAG" \
            | tr '[:upper:]' '[:lower:]' \
            | sed -E 's#[^a-z0-9._-]#-#g; s#/+#-#g; s#^[.-]+##; s#[.-]+$##')"
          TAG="${TAG:0:128}"

          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
          echo "Resolved TAG: $TAG"


      - name: Login to Aliyun ACR
        env:
          ACR_REGISTRY:  ${{ secrets.ACR_REGISTRY }}
          ACR_USERNAME:  ${{ secrets.ACR_USERNAME }}
          ACR_PASSWORD:  ${{ secrets.ACR_PASSWORD }}
        run: |
          set -euo pipefail
          docker logout "$ACR_REGISTRY" || true
          echo "$ACR_PASSWORD" | docker login "$ACR_REGISTRY" \
            --username "$ACR_USERNAME" --password-stdin

      - name: Build Docker Image (proxy_net, one step)
        env:
          IMAGE: ${{ secrets.ACR_REGISTRY }}/${{ secrets.ACR_NAMESPACE }}/${{ vars.IMAGE_NAME }}
          TAG:   ${{ steps.meta.outputs.tag }}
        run: |
          set -euo pipefail

          # 1) 确保网络存在
          docker network inspect proxy_net >/dev/null 2>&1 || docker network create proxy_net

          # 2) 重新创建并启用 builder，加入 proxy_net 且注入默认代理
          docker buildx rm ci-builder >/dev/null 2>&1 || true
          docker buildx create \
            --name ci-builder --use \
            --driver docker-container \
            --driver-opt network=proxy_net \
            --driver-opt env.http_proxy=http://proxy:7890,env.https_proxy=http://proxy:7890 \
            >/dev/null

          # 3) 构建（通过代理）。若想本步直接推仓库，把 --load 改成 --push
          docker buildx build \
            --builder ci-builder \
            --progress=plain \
            --build-arg HTTP_PROXY=http://proxy:7890 \
            --build-arg HTTPS_PROXY=http://proxy:7890 \
            --build-arg NO_PROXY=localhost,127.0.0.1,proxy \
            --load \
            -t "${IMAGE}:${TAG}" -f docker/Dockerfile .


      - name: Push Docker Image
        env:
          IMAGE: ${{ secrets.ACR_REGISTRY }}/${{ secrets.ACR_NAMESPACE }}/${{ vars.IMAGE_NAME }}
          TAG:   ${{ steps.meta.outputs.tag }}
        run: |
          set -euo pipefail
          echo "Pushing ${IMAGE}:${TAG}"
          docker push "${IMAGE}:${TAG}"

          # 如果上一步给了 latest，这里一并推
          if docker image inspect "${IMAGE}:latest" > /dev/null 2>&1; then
            echo "Pushing ${IMAGE}:latest"
            docker push "${IMAGE}:latest"
          fi