name: Dynamic Build and Deploy Hardened Images

on:
  push:
    branches:
      - main
  schedule:
    - cron: '0 0 * * 5'
  workflow_dispatch:

jobs:
  build-and-push:
    strategy:
      matrix:
        runner: [linux-amd64, linux-arm64]
    runs-on: ${{ matrix.runner }}

    steps:
      - name: Checkout Code (SHA-256 Compatible)
        run: |
          git config --global init.defaultObjectFormat sha256
          git init .
          git remote add origin "https://${{ github.token }}@git.chillcog.com/${{ github.repository }}.git"
          git fetch --depth=1 origin ${{ github.sha }}
          git checkout FETCH_HEAD

      - name: Log in to DHI Registry
        run: |
          echo "${{ secrets.DHI_PASSWORD }}" | docker login dhi.io -u "${{ secrets.DHI_USERNAME }}" --password-stdin

      - name: Log in to Gitea Container Registry
        run: |
          echo "${{ secrets.PASSWORD }}" | docker login git.chillcog.com -u "${{ secrets.USERNAME }}" --password-stdin
      
      - name: Detect and Build Images
        env:
          EVENT_NAME: ${{ github.event_name }}
        run: |
          REGISTRY_HOST="git.chillcog.com"
          TARGET_ORG="dhi"

          FILES_TO_BUILD=$(find . -maxdepth 1 \( -name "*.yml" -o -name "*.yaml" \))

          for file in $FILES_TO_BUILD; do
            file=$(echo "$file" | sed 's|^\./||')
            
            [ -f "$file" ] || continue
            
            filename=$(basename -- "$file")
            image_base="${filename%.*}"
            image_name=$(echo "$image_base" | tr '[:upper:]' '[:lower:]')
            
            TARGET_TAG="${REGISTRY_HOST}/${TARGET_ORG}/${image_name}:latest"
            
            echo "---------------------------------------------------"
            echo "Processing: $file -> Target: $TARGET_TAG"
            echo "---------------------------------------------------"
            
            docker build --network=host -f "$file" -t "$TARGET_TAG" .
            docker push "$TARGET_TAG"
          done