name: CI Pipeline

on:
  push:
    branches:
      - main
      - master
    paths:
      - Dockerfile
      - packages.txt
      - requirements.txt
      - .gitea/workflows/main.yml
      - tools/**
  pull_request:
    paths:
      - Dockerfile
      - packages.txt
      - requirements.txt
      - .gitea/workflows/main.yml
      - tools/**
  workflow_dispatch:

jobs:
  build-image:
    name: Build Docker Image
    runs-on: ubuntu:latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v3
        with:
          submodules: recursive
          fetch-depth: 1

      - name: Login to Docker Registry
        run: docker login -u ${{ secrets.CI_USER }} -p ${{ secrets.CI_TOKEN }} ${{ secrets.CI_REGISTRY }}

      - name: Pull existing image (if exists)
        run: docker pull ${{ secrets.CI_REGISTRY_IMAGE }}:${{ github.ref_name }} || true
      - name: Build Docker image
        run: |
          docker build \
            --build-arg BUILDKIT_INLINE_CACHE=1 \
            --cache-from ${{ secrets.CI_REGISTRY_IMAGE }}:${{ github.ref_name }} \
            -t ${{ secrets.CI_REGISTRY_IMAGE }}:${{ github.ref_name }} \
            -t ${{ secrets.CI_REGISTRY_IMAGE }}:latest .

      - name: Push Docker image
        run: docker push --all-tags ${{ secrets.CI_REGISTRY_IMAGE }}

  build-test-us10:
    name: Test US10 Build
    runs-on: ubuntu:latest
    needs: build-image
    container:
      image: ${{ secrets.CI_REGISTRY_IMAGE }}:latest
    steps:
      - name: Download and decrypt baserom
        run: |
          curl -L "${{ secrets.BASEROM_US10_URL }}" -o baserom.us.v10.enc.z64
          openssl enc -d -aes-256-cbc -in baserom.us.v10.enc.z64 -out baserom.us.v10.z64 -k "${{ secrets.BASEROM_US10_KEY}"
          FILE_SHA1=$(sha1sum baserom.us.v10.z64 | awk '{ print $1 }')
          echo "Calculated SHA1 - $FILE_SHA1"
          echo "Expected SHA1 - ${{ secrets.BASEROM_US10_SHA1 }}"
          [ "$FILE_SHA1" != "${{ secrets.BASEROM_US10_SHA1 }}" ] && exit 1 || echo "Checksum verification passed"

      - name: Compile
        run: make

      - name: Verify ROM
        run: |
          FILE_SHA1=$(sha1sum build/us.v10/banjo.us.v10.z64 | awk '{ print $1 }')
          echo "Calculated SHA1 - $FILE_SHA1"
          echo "Expected SHA1 - ${{ secrets.BASEROM_US10_SHA1 }}"
          [ "$FILE_SHA1" != "${{ secrets.BASEROM_US10_SHA1 }}" ] && exit 1 || echo "Checksum verification passed"

  build-test-pal:
    name: Test PAL Build
    runs-on: ubuntu:latest
    needs: build-image
    container:
      image: ${{ secrets.CI_REGISTRY_IMAGE }}:latest
    steps:
      - name: Download and decrypt baserom
        run: |
          curl -L "${{ secrets.BASEROM_PAL_URL }}" -o baserom.pal.enc.z64
          openssl enc -d -aes-256-cbc -in baserom.pal.enc.z64 -out baserom.pal.z64 -k "${{ secrets.BASEROM_PAL_KEY}"
          FILE_SHA1=$(sha1sum baserom.pal.z64 | awk '{ print $1 }')
          echo "Calculated SHA1 - $FILE_SHA1"
          echo "Expected SHA1 - ${{ secrets.BASEROM_PAL_SHA1 }}"
          [ "$FILE_SHA1" != "${{ secrets.BASEROM_PAL_SHA1 }}" ] && exit 1 || echo "Checksum verification passed"

      - name: Compile
        run: make VERSION=pal

      - name: Verify ROM
        run: |
          DECOMP_SHA1=$(sha1sum decompressed.pal.z64 | awk '{ print $1 }')
          FILE_SHA1=$(sha1sum build/pal/banjo.pal.prelim.z64 | awk '{ print $1 }')
          echo "Calculated SHA1 - $FILE_SHA1"
          echo "Expected SHA1 - $DECOMP_SHA1"
          [ "$FILE_SHA1" != "$DECOMP_SHA1" ] && exit 1 || echo "Checksum verification passed"