name: Build Docker Image

on:
  push:
    tags:
      - v*
    branches:
      - master

env:
  APP_NAME: telegram-twitter-media-bot
  DOCKERHUB_REPO: yoursfunny/telegram-twitter-media-bot

jobs:
  # A tag push and a branch push to the same commit fire two workflow runs;
  # build only once. Tag runs always build; master runs build only when the
  # pushed commit is not already tagged (the tag run covers it).
  should-build:
    runs-on: ubuntu-latest
    outputs:
      build: ${{ steps.check.outputs.build }}
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
      - id: check
        shell: bash
        run: |
          if [ "$GITHUB_REF_TYPE" = "branch" ] && git tag --points-at "$GITHUB_SHA" | grep -q .; then
            echo "commit already tagged; the tag run builds the image"
            echo "build=false" >> "$GITHUB_OUTPUT"
          else
            echo "build=true" >> "$GITHUB_OUTPUT"
          fi

  docker:
    needs: should-build
    if: needs.should-build.outputs.build == 'true'
    runs-on: ubuntu-latest
    steps:
      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: ${{ env.DOCKERHUB_REPO }}
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}.{{patch}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
            type=sha
      -
        name: Set up QEMU
        uses: docker/setup-qemu-action@v4
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4
      -
        name: Login to Docker Hub
        uses: docker/login-action@v4
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      # Buildkit cache via the GitHub Actions cache backend (uses the
      # automatic GITHUB_TOKEN, no extra secrets). mode=max keeps every
      # stage's layers so the cargo-deps and ffmpeg layers are restored
      # instead of re-downloaded/recompiled. The scope must be pinned to a
      # fixed string: the gha backend defaults to the current git ref, which
      # would give every new tag a cold cache on release builds.
      -
        name: Build and push
        uses: docker/build-push-action@v7
        with:
          push: true
          build-args: |
            APP_NAME=${{ env.APP_NAME }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha,scope=tgxmb-build
          cache-to: type=gha,mode=max,scope=tgxmb-build