name: Verify and build

on:
  push:
    branches: [main]
    tags: ["v*"]
  pull_request:

jobs:
  verify:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: 22, cache: npm }
      - run: npm ci
      - run: npm audit --omit=dev --audit-level=high
      - run: npx tsc --noEmit
      - run: npm test
      - run: npm run sbom -- artifacts/mebbling.spdx.json
      - uses: actions/upload-artifact@v4
        with:
          name: mebbling-sbom-${{ gitea.sha }}
          path: artifacts/mebbling.spdx.json
      - run: docker build --build-arg APP_VERSION=${{ gitea.ref_name }} -t mebbling:${{ gitea.sha }} .
      # Optional: configure DEPLOY_WEBHOOK_URL as a Gitea Actions secret to notify your host on a v* tag.
      - if: startsWith(gitea.ref, 'refs/tags/v') && secrets.DEPLOY_WEBHOOK_URL != ''
        run: curl --fail --silent --show-error -X POST "$DEPLOY_WEBHOOK_URL" -H "Content-Type: application/json" -d '{"version":"${{ gitea.ref_name }}","commit":"${{ gitea.sha }}"}'