deploy.yml

name: build-and-deploy

# Builds the production image and pushes it to the homelab registry on every
# push to master/main. Any swarm service running this image with the
# `shepherd.enable=true` label rolls to the new build within ~5 minutes.
#
# REQUIRES a self-hosted runner on the homelab LAN — GitHub-hosted runners
# cannot reach 192.168.0.165:5000. The runner host's docker daemon must trust
# the registry (all swarm nodes do, via insecure-registries).

on:
  push:
    branches: [master, main]
  workflow_dispatch:

env:
  REGISTRY: ${{ vars.REGISTRY_HOST || '192.168.0.165:5000' }}

jobs:
  build-push:
    runs-on: [self-hosted, linux, x64]
    steps:
      - uses: actions/checkout@v4

      - name: Compute lowercase image name
        run: echo "IMAGE_NAME=$(echo "${GITHUB_REPOSITORY##*/}" | tr '[:upper:]' '[:lower:]')" >> "$GITHUB_ENV"

      - name: Build image
        run: docker build -t "$REGISTRY/$IMAGE_NAME:latest" -t "$REGISTRY/$IMAGE_NAME:$GITHUB_SHA" .

      - name: Push image (:latest for deploys, :sha for rollback)
        run: |
          docker push "$REGISTRY/$IMAGE_NAME:latest"
          docker push "$REGISTRY/$IMAGE_NAME:$GITHUB_SHA"