name: Podman Promote
description: >
  Promote an existing image in registry.noctrl.eu by retagging it server-side
  (skopeo copy within the same registry — blobs are reused, no rebuild, no
  transfer). Works for single-arch images and multi-arch manifest lists alike.
  Fails if the source tag does not exist; it never falls back to building.

inputs:
  image-name:
    description: Repository/image name path, for example noctrl/gitea-runner
    required: true
  source-tag:
    description: Existing tag to promote, for example sha-abc123
    required: true
  target-tag:
    description: Tag to publish, for example v1.2.3
    required: true
  registry-username:
    description: Registry username for login.
    required: true
  registry-password:
    description: Registry password for login.
    required: true

runs:
  using: composite
  steps:
    - id: promote
      shell: bash
      run: |
        set -euo pipefail

        export REGISTRY_AUTH_FILE="${RUNNER_TEMP}/promote-auth.json"

        if ! command -v skopeo >/dev/null 2>&1; then
          echo "ERROR: skopeo not found on this runner (needs noctrl/gitea-runner >= v10)" >&2
          exit 1
        fi

        image_base="registry.noctrl.eu/${{ inputs.image-name }}"
        source_ref="docker://${image_base}:${{ inputs.source-tag }}"
        target_ref="docker://${image_base}:${{ inputs.target-tag }}"

        cleanup() { rm -f "${REGISTRY_AUTH_FILE}"; }
        trap cleanup EXIT

        echo "${{ inputs.registry-password }}" | skopeo login registry.noctrl.eu \
          --username "${{ inputs.registry-username }}" --password-stdin

        echo "Promoting ${source_ref} -> ${target_ref}"
        # --all: copy every manifest of a multi-arch list, or the single image.
        skopeo copy --all "${source_ref}" "${target_ref}"