name: Build and publish Docker image

on:
  push:
    branches:
      - main
  workflow_dispatch:

permissions:
  contents: read

jobs:
  build-and-publish:
    runs-on: ubuntu-latest
    steps:
      - name: Check out source
        uses: actions/checkout@v4

      - name: Log in to Docker Hub
        env:
          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
        run: |
          printf '%s' "$DOCKERHUB_TOKEN" |
            docker login --username "$DOCKERHUB_USERNAME" --password-stdin

      - name: Build and tag image
        env:
          COMMIT_SHA: ${{ gitea.sha }}
          DOCKER_IMAGE: ${{ secrets.DOCKER_IMAGE }}
        run: |
          docker build \
            --label "org.opencontainers.image.revision=$COMMIT_SHA" \
            --tag "$DOCKER_IMAGE:frontend" \
            .

      - name: Push image
        env:
          DOCKER_IMAGE: ${{ secrets.DOCKER_IMAGE }}
        run: docker push "$DOCKER_IMAGE:frontend"

      - name: Log out from Docker Hub
        if: always()
        run: docker logout