name: CI - Lint, Test, and Push Docker Image

on:
  push:
  pull_request:
    branches: [ "main" ]
  schedule:
    - cron: '0 0 3 * *'  # monthly refresh
  workflow_dispatch:

jobs:
  lint-and-test:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'
          cache: pip

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements.txt
          pip install coverage

      - name: Ruff lint
        run: ruff check .

      - name: Run pytest with coverage
        run: |
          coverage run -m pytest tests/ -v
          coverage report

  build-melange-apko:
    runs-on: ubuntu-latest
    needs: lint-and-test
    if: github.event_name != 'pull_request'
    permissions:
      contents: read
      packages: write
      id-token: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup melange
        uses: chainguard-dev/actions/setup-melange@main

      - name: Generate melange signing keypair
        run: melange keygen melange.rsa

      - name: Build package with melange
        run: |
          melange build melange.yaml \
            --signing-key melange.rsa \
            --arch x86_64,aarch64

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Publish image with apko
        uses: chainguard-images/actions/apko-publish@main
        with:
          config: apko.yaml
          archs: x86_64,aarch64
          tag: ghcr.io/k2patel/apcupsd-client:latest
          keyring-append: melange.rsa.pub