container.yml

name: 'CD -> Container'
on:
    workflow_dispatch:
    push:
        branches: ['stable']

concurrency:
    group: '${{ github.workflow }}-${{ github.ref }}'
    cancel-in-progress: false

permissions:
    contents: read

jobs:
    build:
        if: ${{ github.repository_owner == 'jspaste' }}
        name: 'Build container image'
        runs-on: ubuntu-latest
        permissions:
            packages: write

        env:
            REGISTRY: 'ghcr.io'
            IMAGE_NAME: '${{ github.repository }}'

        steps:
            - name: 'Harden Runner'
              uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
              with:
                  policy: cd-container

            - name: 'Checkout'
              uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

            - name: 'Setup QEMU'
              run: |
                  sudo apt-get update && sudo apt-get install -y qemu-user-static

            - name: 'Setup tags'
              id: setup_tags
              run: |
                  TIMESTAMP="$(date +%Y.%m.%d)"
                  SHA_SHORT="${GITHUB_SHA::7}"

                  TAGS=()
                  TAGS+=("latest")
                  TAGS+=("${GITHUB_SHA}")
                  TAGS+=("${TIMESTAMP}-${SHA_SHORT}")

                  echo "build_tags=${TAGS[*]}" >> $GITHUB_OUTPUT

            - name: 'Build image'
              id: build_image
              uses: redhat-actions/buildah-build@c79846fb306beeba490e89fb75d2d1af95831e79 # master (update to node20)
              with:
                  containerfiles: Containerfile
                  image: ${{ env.IMAGE_NAME }}
                  platforms: 'linux/amd64, linux/arm64'
                  tags: ${{ steps.setup_tags.outputs.build_tags }}
                  oci: true

            - name: 'Push to GHCR'
              uses: redhat-actions/push-to-registry@9986a6552bc4571882a4a67e016b17361412b4df # v2.7.1
              env:
                  REGISTRY_USER: ${{ github.actor }}
                  REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}

              with:
                  image: ${{ steps.build_image.outputs.image }}
                  tags: ${{ steps.build_image.outputs.tags }}
                  registry: ${{ env.REGISTRY }}
                  username: ${{ env.REGISTRY_USER }}
                  password: ${{ env.REGISTRY_PASSWORD }}