image-push.yml

on:
  release:
    types: [published]

permissions:
  contents: read  

jobs:
  push-multiarch:
    permissions:
      contents: read
      id-token: write
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        platform:
          - linux/amd64
          - linux/arm64
    steps:
    - name: Prepare
      run: |
        platform=${{ matrix.platform }}
        echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV  
    - name: Check out code
      uses: actions/checkout@v4

    - name: Docker meta
      id: meta
      uses: docker/metadata-action@v5
      with:
        images: ${{ env.REGISTRY_IMAGE }}
    - name: Set up QEMU
      uses: docker/setup-qemu-action@v3

    # - name: "Read secrets"
    #   uses: rancher-eio/read-vault-secrets@main
    #   with:
    #     secrets: |
    #       secret/data/github/repo/${{ github.repository }}/dockerhub/${{ github.repository_owner }}/credentials username | DOCKER_USERNAME ;
    #       secret/data/github/repo/${{ github.repository }}/dockerhub/${{ github.repository_owner }}/credentials password | DOCKER_PASSWORD

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3

    - name: Login to Container Registry
      uses: docker/login-action@v3
      with:
        username: ${{ secrets.DOCKER_USERNAME }}
        password: ${{ secrets.DOCKER_PASSWORD }}

    - name: Build and push by digest
      id: build
      uses: docker/build-push-action@v5
      with:
        context: .
        push: true
        tags: thomasferrandiz/hardened-calico:${{ github.event.release.tag_name }}
        file: Dockerfile
        platforms: ${{ matrix.platform }}
        outputs: type=image,name=${{ env.REGISTRY_IMAGE }},push-by-digest=true,name-canonical=true,push=true
    - name: Export digest
      run: |
        mkdir -p /tmp/digests
        digest="${{ steps.build.outputs.digest }}"
        touch "/tmp/digests/${digest#sha256:}"          
    
    - name: Upload digest
      uses: actions/upload-artifact@v4
      with:
        name: digests-${{ env.PLATFORM_PAIR }}
        path: /tmp/digests/*
        if-no-files-found: error
        retention-days: 1