name: Push Image Build
on:
  push:
    branches:
      - master
      - release-*
    tags:
      - v*

defaults:
  run:
    # reference: https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#using-a-specific-shell
    shell: bash --noprofile --norc -eo pipefail -x {0}

permissions:
  contents: read
  packages: write
  id-token: write # for cosign OIDC keyless signing

jobs:
  push-image-to-container-registry:
    runs-on: ubuntu-22.04
    if: github.repository == 'rook/rook'
    steps:
      - name: checkout
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          fetch-depth: 0

      - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
        with:
          go-version: "1.25"

        # docker/setup-qemu action installs QEMU static binaries, which are used to run builders for architectures other than the host.
      - name: set up QEMU
        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # master
        with:
          platforms: all

      - name: Install cosign
        uses: sigstore/cosign-installer@v4.0.0 # v3.10.0

      - name: log in to container registry
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Login to Quay.io
        uses: docker/login-action@v3
        with:
          registry: quay.io
          username: ${{ secrets.QUAY_USERNAME }}
          password: ${{ secrets.QUAY_ROBOT_TOKEN }}

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0
        with:
          aws-access-key-id: ${{ secrets.AWS_USR }}
          aws-secret-access-key: ${{ secrets.AWS_PSW }}
          aws-region: us-east-1

      # creating custom env var
      - name: set env
        run: |
          echo "BRANCH_NAME=${GITHUB_REF##*/}" >> $GITHUB_ENV
          echo "GITHUB_REF"=${GITHUB_REF} >> $GITHUB_ENV

      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: 3.13

      - name: Install dependencies
        run: |
          python3 -m pip install --upgrade pip setuptools wheel
          sudo apt-get -q update
          sudo apt-get -q install -y python3-pygit2

      - name: Configure git user
        run: |
          # Use our Rook "service account"
          git config user.name Rook
          git config user.email "cncf-rook-info@lists.cncf.io"

      - name: build and release
        env:
          GIT_API_TOKEN: ${{ secrets.GIT_API_TOKEN }}
          BRANCH_NAME: ${{ env.BRANCH_NAME }}
          AWS_USR: ${{ secrets.AWS_USR }}
          AWS_PSW: ${{ secrets.AWS_PSW }}
          GITHUB_REF: $ {{ env.GITHUB_REF }}
        run: |
          tests/scripts/build-release.sh