pull_request.yaml

name: Deliver Container Image
on:
  pull_request:
    types: [opened, reopened, synchronize]

env:
  IMAGE_NAME: paddock-off
  IMAGE_TAGS: ${{ github.sha }}
  IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }}
  REGISTRY_USER: ${{ github.actor }}
  REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}

permissions:
  contents: read

# https://github.com/pre-commit/action/issues/7#issuecomment-1251300704
#   run only on changed files
jobs:
  build:
    name: build
    runs-on: ubuntu-latest

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1
        with:
          egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v3.5.2

      - name: Buildah Action
        id: build_image
        uses: redhat-actions/buildah-build@7a95fa7ee0f02d552a32753e7414641a04307056 # v2.13
        with:
          image: ${{ env.IMAGE_NAME }}
          tags: ${{ env.IMAGE_TAGS }}
          oci: true
          context: components/paddock
          containerfiles: |
            ./components/paddock/Containerfile