name: Build and push telegraf-snmp image
run-name: ${{ gitea.actor }} is building and pushing telegraf-snmp image
on:
  push:
    paths:
      - 'telegraf-snmp/**'
      - '.gitea/workflows/telegraf-snmp.yaml'

env:
  RESULT_IMAGE_NAME: tools/telegraf-snmp

jobs:
  build-and-push-image:
    runs-on: docker
    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Log in to registry
        uses: docker/login-action@v3
        with:
          registry: ${{ vars.PRIVATE_REGISTRY_DOMAIN }}
          username: ${{ vars.PRIVATE_REGISTRY_USER }}
          password: ${{ secrets.PRIVATE_REGISTRY_PASSWORD }}

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          driver-opts: image=harbor.lan/tools/buildkit-with-ca:latest

      - name: Debug TLS in BuildKit
        run: |
          BUILDER=$(docker ps --filter "name=buildx_buildkit" --format "{{.Names}}" | head -1)
          echo "=== Builder: $BUILDER ==="
          docker exec "$BUILDER" sh -c '
            echo "=== SSL env vars in current shell ==="
            env | grep -iE "ssl|cert|tls|ca_" || echo "none"
            echo "=== All env vars of buildkitd (PID 1) ==="
            cat /proc/1/environ 2>/dev/null | tr "\0" "\n"
            echo "=== Certs in bundle ==="
            grep -c "BEGIN CERTIFICATE" /etc/ssl/certs/ca-certificates.crt 2>/dev/null || echo "bundle not found"
            echo "=== TLS test harbor.lan root ==="
            wget -qO /dev/null https://harbor.lan/ 2>&1 && echo "TLS OK" || echo "TLS FAILED"
            echo "=== TLS test harbor.lan token endpoint ==="
            wget -qO /dev/null https://harbor.lan/service/token 2>&1 && echo "TLS OK" || echo "TLS FAILED"
          '

      - name: Build and push image
        uses: docker/build-push-action@v6
        with:
          context: telegraf-snmp
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ vars.PRIVATE_REGISTRY_DOMAIN }}/${{ env.RESULT_IMAGE_NAME }}:latest