# Build the exact production image on pull requests, publish branch-named images
# for development, and replace `latest` only after a successful main-branch
# push. Keeping every channel in one job prevents a second build path from
# drifting away from what servers actually download.
name: Container image

on:
  pull_request:
  # Every repository branch gets one moving development image. GitHub does not
  # grant package-write access to untrusted fork pull requests, which remain
  # build-only through the separate pull_request event above.
  push:

# Repository contents are read to build the image. Package write access is used
# only by the conditional GHCR login and push steps on repository branch pushes.
permissions:
  contents: read
  packages: write

jobs:
  image:
    runs-on: ubuntu-latest

    steps:
      - name: Check out repository
        uses: actions/checkout@v7

      # Buildx supplies the cache and the explicit amd64 build used both for
      # pull-request verification and publication. QEMU is intentionally absent
      # because the central server image supports only linux/amd64.
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      # GitHub's built-in token can publish to this repository's package. Pull
      # requests never authenticate to GHCR and therefore cannot publish.
      - name: Log in to GHCR
        if: github.event_name == 'push'
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # Docker's maintained metadata action converts branch names into valid
      # container tags, including replacing separators such as `/`. Main gets
      # only `latest`; every other pushed branch gets only its branch tag.
      - name: Select image tag
        id: image-metadata
        uses: docker/metadata-action@v6
        with:
          images: ghcr.io/legop3/multiroombarover
          flavor: latest=false
          tags: |
            type=raw,value=latest,enable={{is_default_branch}}
            type=ref,event=branch,enable={{is_not_default_branch}}

      # The push switch keeps pull requests build-only. Branch images are
      # replaced on each successful push, just as main replaces `latest`.
      - name: Build and optionally publish
        uses: docker/build-push-action@v7
        with:
          context: .
          platforms: linux/amd64
          push: ${{ github.event_name == 'push' }}
          tags: ${{ steps.image-metadata.outputs.tags }}
          cache-from: type=gha
          cache-to: type=gha,mode=max