flowzone.yml

name: Flowzone

on:
  pull_request:
    types: [opened, synchronize, closed]
    branches: [main, master]
  pull_request_target:
    types: [opened, synchronize, closed]
    branches: [main, master]

# Base permissions required by Flowzone
# https://docs.github.com/en/actions/security-for-github-actions/security-guides/automatic-token-authentication#permissions-for-the-github_token
# https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#permissions
permissions:
  actions: none
  attestations: none
  checks: none
  contents: read
  deployments: none
  id-token: none
  issues: none
  discussions: none
  pages: none
  pull-requests: none
  repository-projects: none
  security-events: none
  statuses: none

  # Additional permissions needed by this repo, such as:
  packages: write # Allow Flowzone to publish to ghcr.io

jobs:
  flowzone:
    name: Flowzone
    uses: product-os/flowzone/.github/workflows/flowzone.yml@master
    # prevent duplicate workflow executions for pull_request and pull_request_target
    if: |
      (
        github.event.pull_request.head.repo.full_name == github.repository &&
        github.event_name == 'pull_request'
      ) || (
        github.event.pull_request.head.repo.full_name != github.repository &&
        github.event_name == 'pull_request_target'
      )
    secrets: inherit
    with:
      balena_slugs: |
        balena/cert-manager-amd64,
        balena/cert-manager-aarch64
      docker_images: |
        balena/cert-manager,
        ghcr.io/balena-io/cert-manager