name: Build and push

on:
  push:

jobs:
  check:
    runs-on: selfhosted
    steps:
      - name: Install python
        run: apt-get update && apt-get install -y --no-install-recommends python3-pip python3-venv
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        id: cache-venv
        with:
          path: .venv
          key: venv-${{ hashFiles('pyproject.toml') }}
      - name: Create venv and install
        if: steps.cache-venv.outputs.cache-hit != 'true'
        run: python3 -m venv .venv && .venv/bin/pip install .
      - run: .venv/bin/python -m computer_mcp.check

  build:
    needs: check
    if: github.ref == 'refs/heads/main'
    runs-on: selfhosted
    enable-openid-connect: true
    steps:
      - name: Fetch registry JWT
        id: jwt
        env:
          AUD: u:1:95368150-8b3d-4987-a612-7d2cdb9d36c6
        run: |
          jwt=$(
            curl --fail -sS \
              -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
              "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=$AUD" \
              | node -e 'let d="";process.stdin.on("data",c=>d+=c);process.stdin.on("end",()=>console.log(JSON.parse(d).value))'
          )
          echo "::add-mask::$jwt"
          echo "jwt=$jwt" >> "$FORGEJO_OUTPUT"
      - name: Trigger buildkit build
        uses: https://git.lschaefer.xyz/lukasdotcom/secured-remote-docker-build@2eb905fd6bf10772fe0495df8603b04afb6f6b77 # v1.2.0
        with:
          url: https://buildkit.lschaefer.xyz/build
          token: ${{ secrets.BUILD }}
          commit: ${{ github.sha }}
          tags: |
            git.lschaefer.xyz/lukasdotcom/computer-mcp:latest
          remote: "https://git.lschaefer.xyz"
          username: jwt
          password: ${{ steps.jwt.outputs.jwt }}