/**
 * Logs in to Harbor, builds and pushes a Docker image.
 * Must be called inside container('docker') block.
 * Returns the full image tag used (e.g. "main-a1b2c3d4").
 *
 * config keys:
 *   appName   (required) - image name, e.g. 'tictactoe'
 *   registry  (optional) - Harbor internal service, default: harbor-core.harbor.svc.cluster.local
 *   project   (optional) - Harbor project,          default: library
 *   credId    (optional) - Jenkins credential id,   default: harbor-credentials
 *   tag       (optional) - image tag; auto-generated as <branch>-<random8> if not set
 *   dockerfile(optional) - path to Dockerfile,      default: Dockerfile
 *   context   (optional) - Docker build context,    default: .
 */
def call(Map config) {
    def appName    = config.appName
    if (!appName) error('dockerBuildPush: appName is required')

    def registry   = config.registry   ?: 'harbor-core.harbor.svc.cluster.local'
    def project    = config.project    ?: 'library'
    def credId     = config.credId     ?: 'harbor-credentials'
    def dockerfile = config.dockerfile ?: 'Dockerfile'
    def context    = config.context    ?: '.'
    def tag        = config.tag        ?: "${env.BRANCH_NAME.replaceAll('/', '-')}-${UUID.randomUUID().toString().take(8)}"

    def fullImage  = "${registry}/${project}/${appName}"

    withCredentials([usernamePassword(
        credentialsId: credId,
        usernameVariable: 'HARBOR_USER',
        passwordVariable: 'HARBOR_PASS'
    )]) {
        sh """
            docker login ${registry} -u \${HARBOR_USER} -p \${HARBOR_PASS}
            docker build -f ${dockerfile} -t ${fullImage}:${tag} ${context}
            docker push ${fullImage}:${tag}
        """
    }

    return tag
}