# Build + scan the base images on push. Runs on a Forgejo Actions runner (set up
# in a later phase). Uses the built-in registry; TOKEN/REGISTRY come from repo
# secrets/vars.
name: images
on:
  push:
    branches: [main]
    paths:
      - "site-templates/images/**"
      - ".forgejo/workflows/images.yml"

jobs:
  build-scan:
    runs-on: docker
    steps:
      - uses: actions/checkout@v4

      - name: Secret scan (gitleaks)
        uses: gitleaks/gitleaks-action@v2

      - name: Log in to the registry
        run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login "${{ vars.REGISTRY_HOST }}" -u "${{ vars.REGISTRY_USER }}" --password-stdin

      - name: Build + Trivy-scan + push images
        env:
          REGISTRY: ${{ vars.REGISTRY_HOST }}/heleos
          PUSH: "1"
          SCAN: "1"
        run: ./site-templates/images/build.sh