pre-release.yaml

name: pre-release
on:
  push:
    branches:
      - master

permissions: read-all

env:
  IMAGE_REPO: openpolicyagent/gatekeeper
  CRD_IMAGE_REPO: openpolicyagent/gatekeeper-crds
  GATOR_IMAGE_REPO: openpolicyagent/gator

jobs:
  pre-release:
    name: "Pre Release"
    runs-on: "ubuntu-22.04"
    if: github.ref == 'refs/heads/master' && github.event_name == 'push' && github.repository == 'open-policy-agent/gatekeeper'
    timeout-minutes: 30
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@6b3083af2869dc3314a0257a42f4af696cc79ba3 # v2.3.1
        with:
          egress-policy: audit

      - name: Check out code into the Go module directory
        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab

      - name: Publish development
        run: |
          make docker-login

          tokenUri="https://auth.docker.io/token?service=registry.docker.io&scope=repository:${{ env.IMAGE_REPO }}:pull&scope=repository:${{ env.CRD_IMAGE_REPO }}:pull&scope=repository:${{ env.GATOR_IMAGE_REPO }}:pull"
          bearerToken="$(curl --silent --get $tokenUri | jq --raw-output '.token')"
          listUri="https://registry-1.docker.io/v2/${{ env.IMAGE_REPO }}/tags/list"
          authz="Authorization: Bearer $bearerToken"
          version_list="$(curl --silent --get -H "Accept: application/json" -H "$authz" $listUri | jq --raw-output '.')"
          exists=$(echo $version_list | jq --arg t ${GITHUB_SHA::7} '.tags | index($t)')
          if [[ $exists == null ]]
          then
            make docker-buildx-dev \
              DEV_TAG=${GITHUB_SHA::7} \
              PLATFORM="linux/amd64,linux/arm64,linux/arm/v7" \
              OUTPUT_TYPE=type=registry \
              GENERATE_ATTESTATIONS=true
          fi

          listUri="https://registry-1.docker.io/v2/${{ env.CRD_IMAGE_REPO }}/tags/list"
          version_list="$(curl --silent --get -H "Accept: application/json" -H "$authz" $listUri | jq --raw-output '.')"
          exists=$(echo $version_list | jq --arg t ${GITHUB_SHA::7} '.tags | index($t)')
          if [[ $exists == null ]]
          then
            make docker-buildx-crds-dev \
              DEV_TAG=${GITHUB_SHA::7}
              PLATFORM="linux/amd64,linux/arm64,linux/arm/v7" \
              OUTPUT_TYPE=type=registry \
              GENERATE_ATTESTATIONS=true
          fi

          listUri="https://registry-1.docker.io/v2/${{ env.GATOR_IMAGE_REPO }}/tags/list"
          version_list="$(curl --silent --get -H "Accept: application/json" -H "$authz" $listUri | jq --raw-output '.')"
          exists=$(echo $version_list | jq --arg t ${GITHUB_SHA::7} '.tags | index($t)')
          if [[ $exists == null ]]
          then
            make docker-buildx-gator-dev \
              DEV_TAG=${GITHUB_SHA::7} \
              PLATFORM="linux/amd64,linux/arm64,linux/arm/v7" \
              OUTPUT_TYPE=type=registry \
              GENERATE_ATTESTATIONS=true
          fi
        env:
          DOCKER_USER: ${{ secrets.DOCKER_USER }}
          DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}