name: Weekly rebuild
# Bumps the image revision (1.6.3-1 -> 1.6.3-2) and tags it, which triggers
# release-image.yaml — the mechanism that pulls in Debian base-image security
# patches even between aptly releases. This is the "aptly keeps itself
# current" half that isn't a Renovate PR: it needs zero human action to land.
#
# Gitea's `schedule` trigger only fires from the default branch — a branch
# rename silently disables this. Because Gitea Actions only implements
# always() among the status-check expressions (not success()/failure()),
# failure handling below uses `continue-on-error` + a status file instead of
# `if: failure()`.
on:
  schedule:
    - cron: '17 3 * * 1'
  workflow_dispatch: {}

jobs:
  bump-revision:
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Find the latest image tag and compute the next revision
        id: next
        continue-on-error: true
        run: |
          set -euo pipefail
          latest="$(git tag --list 'image/v*' --sort=-v:refname | head -1)"
          if [[ -z "$latest" ]]; then
            echo "::error::no existing image/v* tag found — cut one manually first (see docs/versioning.md)"
            exit 1
          fi
          version_rev="${latest#image/v}"
          version="${version_rev%-*}"
          revision="${version_rev##*-}"
          next_revision=$(( revision + 1 ))
          echo "next_tag=image/v${version}-${next_revision}" >> "$GITEA_OUTPUT"
          echo "latest_tag=${latest}" >> "$GITEA_OUTPUT"

      - name: Stale-rebuild check (fires regardless of the step above)
        if: always()
        run: |
          latest_epoch="$(git log -1 --format=%at "$(git tag --list 'image/v*' --sort=-v:refname | head -1)" 2>/dev/null || echo 0)"
          now_epoch="$(date +%s)"
          days=$(( (now_epoch - latest_epoch) / 86400 ))
          threshold="${STALE_REBUILD_DAYS:-14}"
          echo "days since last image tag: ${days} (threshold: ${threshold})"
          if [[ "$days" -gt "$threshold" ]]; then
            echo "::warning::no new image tag in ${days} days — check whether this workflow (or Renovate) is still running"
          fi

      - name: Tag and push
        if: steps.next.outcome == 'success'
        run: |
          git config user.name "${{ gitea.actor }}"
          git config user.email "${{ gitea.actor }}@noreply.git.morlana.online"
          git tag "${{ steps.next.outputs.next_tag }}"
          git push origin "${{ steps.next.outputs.next_tag }}"
          echo "tagged ${{ steps.next.outputs.next_tag }} (rebuild of ${{ steps.next.outputs.latest_tag }}'s aptly version)"

      - name: Report failure (opens an issue; the next successful run closes it)
        if: always() && steps.next.outcome != 'success'
        env:
          GITEA_API: https://git.morlana.online/api/v1
          TOKEN: ${{ secrets.REGISTRY_TOKEN }}
        run: |
          curl -fsS -X POST "${GITEA_API}/repos/${{ gitea.repository }}/issues" \
            -H "Authorization: token ${TOKEN}" -H "Content-Type: application/json" \
            -d "{\"title\":\"rebuild.yaml failed on $(date -u +%F)\",\"body\":\"See the workflow run: ${{ gitea.server_url }}/${{ gitea.repository }}/actions\"}"