labels:
  arch: arm64

clone:
  - name: clone
    image: woodpeckerci/plugin-git
    environment:
      CI_NETRC_MACHINE: git.oleks.space
      CI_NETRC_USERNAME: oleks
      CI_NETRC_PASSWORD:
        from_secret: gitea_clone_token
      PLUGIN_TAGS: "false"
      PLUGIN_DEPTH: "1"

when:
  - event: push
    branch: [main, master]
  - event: tag
    ref: "refs/tags/v*"

steps:
  - name: build-and-push
    image: git.oleks.space/oleks/nix-ci:latest
    environment:
      GITEA_CLONE_TOKEN:
        from_secret: gitea_clone_token
      # Single token env var shared by CI + local parity (emmett#44).
      REGISTRY_TOKEN:
        from_secret: registry_token
    backend_options:
      kubernetes:
        resources:
          requests:
            memory: 4Gi
    commands:
      - echo "▸ arch=$(uname -m)"
      # Bootstrap nix substituters and netrc — same as siblings in this repo.
      - echo "79.76.48.244 git.oleks.space nix-cache-upload.oleks.space" >>/etc/hosts
      - |
        cat >>/etc/nix/nix.conf <<'EOF'
        experimental-features = nix-command flakes
        trusted-substituters = https://nix-cache-mirror.oleks.space https://nix-cache-custom.oleks.space/attic-infra-cache-k3s-1
        substituters = https://nix-cache-mirror.oleks.space https://nix-cache-custom.oleks.space/attic-infra-cache-k3s-1
        trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs= attic-infra-cache-k3s-1:qYSNK3DmttQXCFqn1t50qoWGtQNPRFWq9mgQjD05DeU=
        EOF
      - if [ -n "$GITEA_CLONE_TOKEN" ]; then echo "machine git.oleks.space login oleks password $GITEA_CLONE_TOKEN" >~/.netrc && chmod 600 ~/.netrc; fi

      # Thin front door: CI and `nix run .#publish` on emmett run the exact
      # same shared parity-lib nix2container app (emmett#44, cluster #201).
      # `.#publish` pushes :<ver>-arm64, assembles the index :<ver>, and mirrors
      # :latest. Dry-run by default; PUBLISH=1 makes it actually push.
      - PUBLISH=1 nix run .#publish