name: Build CI Image
permissions:
  contents: read

on:
  # Rebuild weekly (Monday 6am UTC) to pick up CLI updates
  schedule:
    - cron: '0 6 * * 1'
  # Rebuild on Dockerfile or lockfile changes
  push:
    branches: [main]
    paths:
      - '.github/docker/Dockerfile.ci'
      - 'package.json'
      - 'bun.lock'
  # Manual trigger
  workflow_dispatch:

concurrency:
  group: ci-image
  cancel-in-progress: false

jobs:
  build:
    runs-on: ubicloud-standard-8
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      # Copy lockfile + package.json into Docker build context
      - run: cp package.json bun.lock .github/docker/

      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
        with:
          context: .github/docker
          file: .github/docker/Dockerfile.ci
          push: true
          tags: |
            ghcr.io/${{ github.repository }}/ci:latest
            ghcr.io/${{ github.repository }}/ci:${{ github.sha }}