name: build-and-push

# CI/CD-pipeline demo (it-admin-3g4): build -> push naar de lokale registry.
# De act_runner (crafity-qnap-runner) draait deze job in zijn DinD.

on:
  push:
    branches: [main]

jobs:
  build-push:
    runs-on: alpine
    container:
      image: alpine:latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install docker CLI
        run: apk add --no-cache docker-cli

      - name: Registry login
        env:
          REG_USER: ${{ secrets.REGISTRY_USER }}
          REG_PW: ${{ secrets.REGISTRY_PASSWORD }}
        run: echo "$REG_PW" | docker login 10.0.0.18:5000 -u "$REG_USER" --password-stdin

      - name: Build image
        run: docker build -t 10.0.0.18:5000/ci-pipeline-demo:${{ github.sha }} -t 10.0.0.18:5000/ci-pipeline-demo:latest .

      - name: Push image
        run: |
          docker push 10.0.0.18:5000/ci-pipeline-demo:${{ github.sha }}
          docker push 10.0.0.18:5000/ci-pipeline-demo:latest

      # ---------------------------------------------------------------------
      # DEPLOY-ROUTE (per repo instelbaar):
      #
      # Route A (Action deployt direct) - uncomment voor instant deploy.
      # Vereist dat de runner de doel-container-engine bereikt. Alleen voor
      # vertrouwde repos (geeft CI effectief host-toegang).
      #   - name: Deploy (route A)
      #     run: |
      #       docker pull 10.0.0.18:5000/ci-pipeline-demo:latest
      #       docker rm -f ci-pipeline-demo || true
      #       docker run -d --name ci-pipeline-demo 10.0.0.18:5000/ci-pipeline-demo:latest
      #
      # Route B (Dockhand deployt) - GEEN deploy-stap hier. Zet op de doel-container
      # het label dockhand.update=true; Dockhand pollt de registry en deployt met
      # safe-pull + rollback. Trager (poll-interval) maar met veiligheidsklep.
      # ---------------------------------------------------------------------