name: anubis-reskin
on:
  schedule: [{ cron: '17 6 * * *' }]
  workflow_dispatch:
env:
  UPSTREAM: TecharoHQ/anubis
  IMAGE: git.kernel.rip/sesh/anubis
  REGISTRY: git.kernel.rip
jobs:
  reskin:
    runs-on: ubuntu-latest
    steps:
      - name: Latest upstream tag
        id: up
        run: echo "tag=$(curl -fsSL https://api.github.com/repos/$UPSTREAM/releases/latest | jq -r .tag_name)" >>"$GITHUB_OUTPUT"
      - uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ secrets.REG_USER }}
          password: ${{ secrets.REG_TOKEN }}
      - name: Skip if already built
        id: check
        run: |
          docker manifest inspect "$IMAGE:${{ steps.up.outputs.tag }}" >/dev/null 2>&1 \
            && echo "build=false" >>"$GITHUB_OUTPUT" \
            || echo "build=true" >>"$GITHUB_OUTPUT"
      - if: steps.check.outputs.build == 'true'
        uses: actions/checkout@v4                    # overlay repo
      - if: steps.check.outputs.build == 'true'
        name: Checkout upstream at tag
        run: |
          git clone --depth 1 --branch "${{ steps.up.outputs.tag }}" \
            https://github.com/TecharoHQ/anubis.git upstream
      - if: steps.check.outputs.build == 'true'
        name: Overlay + drift guard
        run: |
          for f in happy pensive reject; do
            test -f "upstream/web/static/img/$f.webp" || { echo "::error::missing $f.webp upstream"; exit 1; }
          done
          cp mascot/*.webp upstream/web/static/img/
      - if: steps.check.outputs.build == 'true'
        name: Build & push reskinned image
        run: |
          docker buildx create --use --name b 2>/dev/null || docker buildx use b
          docker buildx build upstream \
            --file Dockerfile \
            --platform linux/amd64 \
            --tag "$IMAGE:${{ steps.up.outputs.tag }}" \
            --tag "$IMAGE:latest" \
            --push