stages:
  - build

# Builds BOTH production image flavors (see Dockerfile) and pushes them to this
# project's GitLab Container Registry:
#   - default target `runtime`      → :<sha> / :latest             (Bun-only)
#   - target `with-server-engine`   → :<sha>-server-engine /
#                                     :latest-server-engine        (+ python3 / faster-whisper)
#
#   docker run -p 3000:3000 -v whisper-data:/app/data $CI_REGISTRY_IMAGE:latest
#   docker run -p 3000:3000 -v whisper-data:/app/data $CI_REGISTRY_IMAGE:latest-server-engine
build-image:
  stage: build
  image: docker:27
  services:
    - docker:27-dind
  variables:
    DOCKER_TLS_CERTDIR: "/certs"
    IMAGE_SHA: $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA
    IMAGE_LATEST: $CI_REGISTRY_IMAGE:latest
    IMAGE_SHA_FW: $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA-server-engine
    IMAGE_LATEST_FW: $CI_REGISTRY_IMAGE:latest-server-engine
  before_script:
    - echo "$CI_REGISTRY_PASSWORD" | docker login -u "$CI_REGISTRY_USER" --password-stdin "$CI_REGISTRY"
  script:
    - docker build --pull -t "$IMAGE_SHA" .
    # Fully tag + push this image (including :latest) before building
    # with-server-engine below. That build shares almost all layers with this
    # one (it extends the runtime stage), and building a second image sharing
    # content with an already-tagged one is a known containerd-image-store/
    # buildx bug where the earlier tag's local reference can stop resolving
    # ("tag does not exist" on push) — see moby/moby#52897 and
    # docker/setup-buildx-action#116. Finishing all push/tag work on this
    # image first closes that window.
    - |
      if [ "$CI_COMMIT_BRANCH" = "$CI_DEFAULT_BRANCH" ]; then
        docker tag "$IMAGE_SHA" "$IMAGE_LATEST"
      fi
    - docker push "$IMAGE_SHA"
    - |
      if [ "$CI_COMMIT_BRANCH" = "$CI_DEFAULT_BRANCH" ]; then
        docker push "$IMAGE_LATEST"
      fi
    # with-server-engine extends the runtime stage, so this build reuses every
    # layer from the one above and only adds the python/faster-whisper layer.
    - docker build --target with-server-engine -t "$IMAGE_SHA_FW" .
    - |
      if [ "$CI_COMMIT_BRANCH" = "$CI_DEFAULT_BRANCH" ]; then
        docker tag "$IMAGE_SHA_FW" "$IMAGE_LATEST_FW"
      fi
    - docker push "$IMAGE_SHA_FW"
    - |
      if [ "$CI_COMMIT_BRANCH" = "$CI_DEFAULT_BRANCH" ]; then
        docker push "$IMAGE_LATEST_FW"
      fi
  rules:
    - if: $CI_COMMIT_BRANCH