stack/.woodpecker/rebuild-all.yml

when:
  - event: manual

steps:
  - name: build-push-notebooks
    image: woodpeckerci/plugin-docker-buildx
    settings:
      repo: localhost:3000/homelab/notebooks
      dockerfile: notebooks/Dockerfile
      context: notebooks/
      tags:
        - "sha-${CI_COMMIT_SHA:0:8}"
        - latest
      daemon_off: true
      insecure: true
      username:
        from_secret: registry_user
      password:
        from_secret: registry_pass
    volumes:
      - /run/user/1000/docker.sock:/var/run/docker.sock

  - name: build-push-zotero
    image: woodpeckerci/plugin-docker-buildx
    settings:
      repo: localhost:3000/homelab/zotero
      dockerfile: zotero/Dockerfile
      context: zotero/
      tags:
        - "sha-${CI_COMMIT_SHA:0:8}"
        - latest
      daemon_off: true
      insecure: true
      username:
        from_secret: registry_user
      password:
        from_secret: registry_pass
    volumes:
      - /run/user/1000/docker.sock:/var/run/docker.sock

  - name: prep-docs-context
    image: alpine:3
    volumes:
      - /home/kert/stack/data:/host-data:ro
    commands:
      - mkdir -p data
      - cp /host-data/bib.sqlite data/ 2>/dev/null || true

  - name: build-push-docs
    image: woodpeckerci/plugin-docker-buildx
    settings:
      repo: localhost:3000/homelab/docs
      dockerfile: docs/Dockerfile
      context: .
      tags:
        - "sha-${CI_COMMIT_SHA:0:8}"
        - latest
      daemon_off: true
      insecure: true
      username:
        from_secret: registry_user
      password:
        from_secret: registry_pass
    volumes:
      - /run/user/1000/docker.sock:/var/run/docker.sock
    depends_on:
      - prep-docs-context

  - name: build-push-api
    image: woodpeckerci/plugin-docker-buildx
    settings:
      repo: localhost:3000/homelab/api
      dockerfile: api/Dockerfile
      context: .
      tags:
        - "sha-${CI_COMMIT_SHA:0:8}"
        - latest
      daemon_off: true
      insecure: true
      username:
        from_secret: registry_user
      password:
        from_secret: registry_pass
    volumes:
      - /run/user/1000/docker.sock:/var/run/docker.sock

  - name: build-push-mc
    image: woodpeckerci/plugin-docker-buildx
    settings:
      repo: localhost:3000/homelab/mc
      dockerfile: rustfs/Dockerfile.mc
      context: rustfs/
      tags:
        - "sha-${CI_COMMIT_SHA:0:8}"
        - latest
      daemon_off: true
      insecure: true
      username:
        from_secret: registry_user
      password:
        from_secret: registry_pass
    volumes:
      - /run/user/1000/docker.sock:/var/run/docker.sock

  - name: scan-notebooks
    image: woodpeckerci/plugin-trivy
    settings:
      image_ref: "localhost:3000/homelab/notebooks:sha-${CI_COMMIT_SHA:0:8}"
      severity: HIGH,CRITICAL
      exit_code: 0
    volumes:
      - /run/user/1000/docker.sock:/var/run/docker.sock
    depends_on:
      - build-push-notebooks

  - name: scan-zotero
    image: woodpeckerci/plugin-trivy
    settings:
      image_ref: "localhost:3000/homelab/zotero:sha-${CI_COMMIT_SHA:0:8}"
      severity: HIGH,CRITICAL
      exit_code: 0
    volumes:
      - /run/user/1000/docker.sock:/var/run/docker.sock
    depends_on:
      - build-push-zotero

  - name: scan-api
    image: woodpeckerci/plugin-trivy
    settings:
      image_ref: "localhost:3000/homelab/api:sha-${CI_COMMIT_SHA:0:8}"
      severity: HIGH,CRITICAL
      exit_code: 0
    volumes:
      - /run/user/1000/docker.sock:/var/run/docker.sock
    depends_on:
      - build-push-api

  - name: deploy
    image: docker:cli
    volumes:
      - /run/user/1000/docker.sock:/var/run/docker.sock
      - /home/kert/stack:/home/kert/stack
    commands:
      - cd /home/kert/stack
      - TAG=sha-${CI_COMMIT_SHA:0:8}
      - sed -i "s/^COMMIT_SHA=.*/COMMIT_SHA=$TAG/" .env 2>/dev/null || echo "COMMIT_SHA=$TAG" >> .env
      - docker compose up -d --remove-orphans
    depends_on:
      - scan-notebooks
      - scan-zotero
      - scan-api
      - build-push-docs

  # ── Failure reporter ─────────────────────────────────────────
  - name: report-failure
    image: ghcr.io/astral-sh/uv:python3.13-bookworm-slim
    environment:
      UV_PYTHON_PREFERENCE: only-system
      UV_LINK_MODE: copy
      UV_PROJECT_ENVIRONMENT: .venv
      GITEA_TOKEN:
        from_secret: gitea_token
    commands:
      - uv sync --no-dev
      - uv run python -m api.diag
    when:
      - status: [failure]