name: build-image

on:
  push:
    branches: [main]
    tags: ["v*"]
  workflow_dispatch:

permissions:
  contents: read
  packages: write

jobs:
  test:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    env:
      API_KEY: test
      ATHLETE_ID: i1
    steps:
      - uses: actions/checkout@v4
      - name: Install uv (self-contained; avoids the cold-cache setup-python failure)
        run: |
          curl -LsSf https://astral.sh/uv/install.sh | sh
          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
      - name: Install dependencies (Python 3.12, locked)
        run: uv sync --all-extras --locked --python 3.12
      - name: Test + coverage gate (>=90%)
        run: uv run --locked pytest

  build:
    needs: test
    runs-on: ubuntu-latest
    timeout-minutes: 20
    env:
      IMAGE: git.farh.net/farhoodlabs/intervalsicu-mcp
      DOCKER_BUILDKIT: "1"
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Environment
        run: |
          docker version || true
          df -h / || true

      - name: Login to registry
        run: |
          echo "${{ secrets.REGISTRY_TOKEN }}" | docker login git.farh.net -u cpfarhood --password-stdin

      - name: Build and push image
        run: |
          # Always tag the immutable commit SHA. On a version tag (refs/tags/vX.Y.Z)
          # also publish the semver (X.Y.Z) so images can be pinned, and move :latest.
          # On a main-branch push, publish :latest.
          REFS="${IMAGE}:${GITHUB_SHA}"
          case "${GITHUB_REF}" in
            refs/tags/v*)
              VERSION="${GITHUB_REF#refs/tags/v}"
              REFS="${REFS} ${IMAGE}:${VERSION} ${IMAGE}:latest"
              ;;
            *)
              REFS="${REFS} ${IMAGE}:latest"
              ;;
          esac

          BUILD_ARGS=""
          for r in ${REFS}; do BUILD_ARGS="${BUILD_ARGS} -t ${r}"; done
          docker build --progress=plain ${BUILD_ARGS} .

          for r in ${REFS}; do docker push "${r}"; done
          echo "pushed: ${REFS}"