name: "Push Docker Image"

on:
  workflow_call:
    inputs:
      ref:
        description: "Git ref to build the docker image from"
        required: true
        type: string
      is_master:
        description: "Whether run from master branch"
        required: true
        type: boolean
    secrets:
      DOCKERHUB_USERNAME:
        required: true
      DOCKERHUB_TOKEN:
        required: true

permissions: {}

jobs:
  # Steps to test CI automation in your own fork.
  # 1. Sign-up for https://hub.docker.com/
  # 2. Store your dockerhub username as DOCKERHUB_USERNAME in "Repository secrets" of your fork repository settings (https://github.com/$githubuser/nix/settings/secrets/actions)
  # 3. Create an access token in https://hub.docker.com/settings/security and store it as DOCKERHUB_TOKEN in "Repository secrets" of your fork
  check_secrets:
    permissions:
      contents: none
    name: Check presence of secrets
    runs-on: ubuntu-24.04
    outputs:
      docker: ${{ steps.secret.outputs.docker }}
    steps:
      - name: Check for DockerHub secrets
        id: secret
        env:
          _DOCKER_SECRETS: ${{ secrets.DOCKERHUB_USERNAME }}${{ secrets.DOCKERHUB_TOKEN }}
        run: |
          echo "docker=${{ env._DOCKER_SECRETS != '' }}" >> $GITHUB_OUTPUT

  push:
    name: Push docker image to DockerHub and GHCR
    needs: [check_secrets]
    permissions:
      contents: read
      packages: write
    if: needs.check_secrets.outputs.docker == 'true'
    runs-on: ubuntu-24.04
    steps:
    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
      with:
        fetch-depth: 0
        ref: ${{ inputs.ref }}
    - uses: ./.github/actions/install-nix-action
      with:
        dogfood: false
        extra_nix_config: |
          experimental-features = flakes nix-command
    - run: echo NIX_VERSION="$(nix eval .\#nix.version | tr -d \")" >> $GITHUB_ENV
    - run: nix build .#dockerImage -L
    - run: docker load -i ./result/image.tar.gz
    # We'll deploy the newly built image to both Docker Hub and Github Container Registry.
    #
    # Push to Docker Hub first
    - name: Login to Docker Hub
      uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
      with:
        username: ${{ secrets.DOCKERHUB_USERNAME }}
        password: ${{ secrets.DOCKERHUB_TOKEN }}
    - name: Push to Docker Hub
      env:
        IS_MASTER: ${{ inputs.is_master }}
        DOCKERHUB_REPO: ${{ secrets.DOCKERHUB_USERNAME }}/nix
      run: |
        docker tag nix:$NIX_VERSION $DOCKERHUB_REPO:$NIX_VERSION
        docker push $DOCKERHUB_REPO:$NIX_VERSION
        if [ "$IS_MASTER" = "true" ]; then
          docker tag nix:$NIX_VERSION $DOCKERHUB_REPO:master
          docker push $DOCKERHUB_REPO:master
        fi
    # Push to GitHub Container Registry as well
    - name: Login to GitHub Container Registry
      uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
      with:
        registry: ghcr.io
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    - name: Push to GHCR
      env:
        IS_MASTER: ${{ inputs.is_master }}
      run: |
        IMAGE_ID=ghcr.io/${{ github.repository_owner }}/nix
        IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]')

        docker tag nix:$NIX_VERSION $IMAGE_ID:$NIX_VERSION
        docker push $IMAGE_ID:$NIX_VERSION
        if [ "$IS_MASTER" = "true" ]; then
          docker tag nix:$NIX_VERSION $IMAGE_ID:master
          docker push $IMAGE_ID:master
        fi