name: Build, test and publish
on:
  push:
    branches: ['**']

jobs:
  verify:
    runs-on: @RUNNER@
    env:
      CI: 'true'
      TARGET_PLATFORM: ${{ vars.TARGET_PLATFORM }}
      GITEA_SERVER_URL: ${{ gitea.server_url }}
      CI_REPOSITORY: ${{ gitea.repository }}
      CI_COMMIT: ${{ gitea.sha }}
      CI_REF: ${{ gitea.ref }}
      CI_RUN_ID: ${{ gitea.run_id }}
    steps:
      - name: Check out pushed commit
        uses: https://github.com/actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
        with:
          persist-credentials: false
      - name: Verify pinned engineering resources
        run: python3 scripts/engineering.py --check
      - name: Identify workflow attempt
        # Gitea 1.25 does not populate gitea.run_attempt. Use a unique value for
        # container names and diagnostic artifacts, including reruns of one SHA.
        run: java generated/ci/Ci.java attempt
      - name: Build and test both images
        run: java generated/ci/Ci.java verify
      - name: Publish verified main images
        if: success() && gitea.ref == 'refs/heads/main'
        env:
          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
        run: java generated/ci/Ci.java publish
      - name: Collect diagnostics and clean up test containers
        if: always()
        run: java generated/ci/Ci.java cleanup
      - name: Retain diagnostics for fourteen days
        if: always()
        uses: https://github.com/actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5
        with:
          name: diagnostics-${{ gitea.run_id }}-${{ env.CI_RUN_ATTEMPT }}
          path: ci/artifacts/
          if-no-files-found: error
          retention-days: 14