pre-release.yaml

name: pre-release
on:
  push:
    branches:
      - master

permissions: read-all

env:
  IMAGE_REPO: openpolicyagent/gatekeeper
  CRD_IMAGE_REPO: openpolicyagent/gatekeeper-crds
  GATOR_IMAGE_REPO: openpolicyagent/gator

jobs:
  pre-release:
    name: "Pre Release"
    runs-on: "ubuntu-22.04"
    if: github.ref == 'refs/heads/master' && github.event_name == 'push' && github.repository == 'open-policy-agent/gatekeeper'
    timeout-minutes: 30
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
        with:
          egress-policy: audit

      - name: Check out code into the Go module directory
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11

      - name: Publish development
        run: |
          make docker-login

          tokenUri="https://auth.docker.io/token?service=registry.docker.io&scope=repository:${{ env.IMAGE_REPO }}:pull&scope=repository:${{ env.CRD_IMAGE_REPO }}:pull&scope=repository:${{ env.GATOR_IMAGE_REPO }}:pull"
          bearerToken="$(curl --silent --get $tokenUri | jq --raw-output '.token')"
          listUri="https://registry-1.docker.io/v2/${{ env.IMAGE_REPO }}/tags/list"
          authz="Authorization: Bearer $bearerToken"
          version_list="$(curl --silent --get -H "Accept: application/json" -H "$authz" $listUri | jq --raw-output '.')"
          exists=$(echo $version_list | jq --arg t ${GITHUB_SHA::7} '.tags | index($t)')
          if [[ $exists == null ]]
          then
            make docker-buildx-dev \
              DEV_TAG=${GITHUB_SHA::7} \
              PLATFORM="linux/amd64,linux/arm64,linux/arm/v7" \
              OUTPUT_TYPE=type=registry \
              GENERATE_ATTESTATIONS=true
          fi

          listUri="https://registry-1.docker.io/v2/${{ env.CRD_IMAGE_REPO }}/tags/list"
          version_list="$(curl --silent --get -H "Accept: application/json" -H "$authz" $listUri | jq --raw-output '.')"
          exists=$(echo $version_list | jq --arg t ${GITHUB_SHA::7} '.tags | index($t)')
          if [[ $exists == null ]]
          then
            make docker-buildx-crds-dev \
              DEV_TAG=${GITHUB_SHA::7} \
              PLATFORM="linux/amd64,linux/arm64" \
              OUTPUT_TYPE=type=registry \
              GENERATE_ATTESTATIONS=true
          fi

          listUri="https://registry-1.docker.io/v2/${{ env.GATOR_IMAGE_REPO }}/tags/list"
          version_list="$(curl --silent --get -H "Accept: application/json" -H "$authz" $listUri | jq --raw-output '.')"
          exists=$(echo $version_list | jq --arg t ${GITHUB_SHA::7} '.tags | index($t)')
          if [[ $exists == null ]]
          then
            make docker-buildx-gator-dev \
              DEV_TAG=${GITHUB_SHA::7} \
              PLATFORM="linux/amd64,linux/arm64,linux/arm/v7" \
              OUTPUT_TYPE=type=registry \
              GENERATE_ATTESTATIONS=true
          fi
        env:
          DOCKER_USER: ${{ secrets.DOCKER_USER }}
          DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}