name: build-agent
on:
  push:
    branches: [main]
    paths:
      - "agent/**"
      - ".gitea/workflows/build.yml"
  workflow_dispatch: {}

jobs:
  build-and-push:
    runs-on: docker
    # Default auto-token permission on this instance is read-only for packages;
    # pushing to the container registry needs write explicitly.
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4

      - name: Log in to Gitea registry
        # The auto-generated secrets.GITEA_TOKEN doesn't work against the registry's
        # /v2/ auth endpoint regardless of permissions granted (known Gitea limitation);
        # a real personal access token stored as REGISTRY_TOKEN is required instead.
        run: |
          echo "${{ secrets.REGISTRY_TOKEN }}" | docker login "${{ vars.REGISTRY_HOST }}" \
            -u "${{ gitea.actor }}" --password-stdin

      - name: Build and push claude-agent image
        run: |
          IMAGE="${{ vars.REGISTRY_HOST }}/${{ gitea.repository }}/claude-agent:latest"
          docker build -t "$IMAGE" ./agent
          docker push "$IMAGE"

      - name: Trigger Portainer redeploy
        # Deliberately NOT a separate Gitea repo webhook firing in parallel on the same
        # push — that raced with this build and could redeploy before the new image was
        # actually pushed, silently keeping the old code running. Chaining it here as the
        # last step guarantees the image exists before Portainer goes to pull it.
        run: curl -f -X POST "${{ secrets.PORTAINER_WEBHOOK_URL }}"