push_to_main.yaml

name: Deliver Container Image
on:
  push:
    branches:
      - main

env:
    IMAGE_NAME: paddock
    IMAGE_TAGS: latest ${{ github.sha }}
    IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }}
    REGISTRY_USER: ${{ github.actor }}
    REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}

permissions:
  contents: read

jobs:
  build:
    name: build and push
    runs-on: ubuntu-latest
    permissions:
      packages: write

    steps:
    - name: Harden Runner
      uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
      with:
        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v3.5.2

    - name: Buildah Action
      id: build_image
      uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2.12
      with:
        image: ${{ env.IMAGE_NAME }}
        tags: ${{ env.IMAGE_TAGS }}
        oci: true
        context: components/paddock
        containerfiles: |
          ./components/paddock/Containerfile

    - name: Push To GitHub Container Registry
      uses: redhat-actions/push-to-registry@9986a6552bc4571882a4a67e016b17361412b4df # v2.7.1
      id: push_to_ghcr
      with:
        image: ${{ steps.build_image.outputs.image }}
        tags: ${{ steps.build_image.outputs.tags }}
        registry: ${{ env.IMAGE_REGISTRY }}
        username: ${{ env.REGISTRY_USER }}
        password: ${{ env.REGISTRY_PASSWORD }}
        extra-args: |
          --disable-content-trust

    - name: Echo outputs
      run: |
        echo "${{ toJSON(steps.push.outputs) }}"