push_to_main.yaml

name: Deliver Container Image
on:
  push:
    branches:
      - main

env:
    IMAGE_NAME: paddock-off
    IMAGE_TAGS: latest ${{ github.sha }}
    IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }}
    REGISTRY_USER: ${{ github.actor }}
    REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}

permissions:
  contents: read

jobs:
  build:
    name: build and push
    runs-on: ubuntu-latest
    permissions:
      packages: write

    steps:
    - name: Harden Runner
      uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1
      with:
        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v3.5.2

    - name: Buildah Action
      id: build_image
      uses: redhat-actions/buildah-build@7a95fa7ee0f02d552a32753e7414641a04307056 # v2.13
      with:
        image: ${{ env.IMAGE_NAME }}
        tags: ${{ env.IMAGE_TAGS }}
        oci: true
        context: components/paddock
        containerfiles: |
          ./components/paddock/Containerfile

    - name: Push To GitHub Container Registry
      uses: redhat-actions/push-to-registry@5ed88d269cf581ea9ef6dd6806d01562096bee9c # v2.8
      id: push_to_ghcr
      with:
        image: ${{ steps.build_image.outputs.image }}
        tags: ${{ steps.build_image.outputs.tags }}
        registry: ${{ env.IMAGE_REGISTRY }}
        username: ${{ env.REGISTRY_USER }}
        password: ${{ env.REGISTRY_PASSWORD }}
        extra-args: |
          --disable-content-trust

    - name: Echo outputs
      run: |
        echo "${{ toJSON(steps.push.outputs) }}"