# Our fork of rgit (github.com/w4/rgit), the read-only git web frontend at
# git.quinefoundation.com. On every push to main: build the image from this
# repo's Dockerfile, natively for arm64 (the forge VM, where it runs, is
# arm64), push it to the forge's registry, and open a petersweb-infra PR that
# pins it (quine-global/site-image). Merging that PR deploys it.
#
# Upstream's .github/workflows don't run here: Forgejo reads .forgejo/
# instead when it exists.
#
# Secrets: REGISTRY_USERNAME / REGISTRY_PASSWORD (package write), INFRA_TOKEN
# (pushes a branch to Cold-Air-Networks/petersweb-infra and opens a PR).
name: deploy

on:
  push:
    branches: [main]
  workflow_dispatch:

concurrency:
  group: deploy-${{ github.ref }}
  cancel-in-progress: true

jobs:
  image:
    runs-on: runner-arm64-linux
    # The Dockerfile builds rgit with Nix inside the build (Rust, RocksDB):
    # long the first time, cached by the Nix binary caches afterwards.
    timeout-minutes: 120
    steps:
      - uses: https://forge.in.quineglobal.com/quine-global-labs/mirror-actions-checkout@v4

      - uses: https://forge.in.quineglobal.com/quine-global/site-image@v1
        with:
          image: forge.in.quineglobal.com/quine-global/rgit
          infra-file: nixos/rgit.nix
          name: rgit
          platform: linux/arm64
          registry-username: ${{ secrets.REGISTRY_USERNAME }}
          registry-password: ${{ secrets.REGISTRY_PASSWORD }}
          infra-token: ${{ secrets.INFRA_TOKEN }}
          server: https://forge.in.quineglobal.com