name: Build runner image

on:
  workflow_dispatch:

env:
  NIX_CONFIG: experimental-features = nix-command flakes

jobs:
  build:
    runs-on: nixos
    steps:
      - name: Install checkout dependency
        run: nix profile add nixpkgs#nodejs_24

      - name: Check out repository
        uses: https://data.forgejo.org/actions/checkout@v4
        with:
          persist-credentials: false

      - name: Configure registry authentication
        env:
          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
        run: |
          set -eu
          mkdir -p .docker
          AUTH="$(printf '%s' "$REGISTRY_USER:$REGISTRY_TOKEN" | base64 -w 0)"
          printf '{"auths":{"git.methanium.net":{"auth":"%s"}}}\n' "$AUTH" > .docker/config.json

      - name: Build and publish image
        uses: docker://ghcr.io/osscontainertools/kaniko:v1.28.3
        env:
          DOCKER_CONFIG: ${{ forgejo.workspace }}/.docker
        with:
          entrypoint: /kaniko/executor
          args: >-
            --context=${{ forgejo.workspace }}
            --dockerfile=${{ forgejo.workspace }}/Dockerfile
            --destination=git.methanium.net/alois/nixos-docker-container:2.32.8
            --push-retry=3