my-rook-config/.github/workflows/push-build.yaml

name: Push Image Build
on:
  push:
    branches:
      - master
      - release-*
    tags:
      - v*

defaults:
  run:
    # reference: https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#using-a-specific-shell
    shell: bash --noprofile --norc -eo pipefail -x {0}

permissions: {}

jobs:
  push-image-to-container-registry:
    runs-on: ubuntu-22.04
    if: github.repository == 'rook/rook'
    permissions:
      contents: read
      packages: write
      id-token: write # for cosign OIDC keyless signing
    steps:
      - name: checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: validate release version
        if: startsWith(github.ref, 'refs/tags/v')
        env:
          TAG_NAME: ${{ github.ref_name }}
        run: build/release/validate-tag.sh "$TAG_NAME"

      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: "1.26"

        # docker/setup-qemu action installs QEMU static binaries, which are used to run builders for architectures other than the host.
      - name: set up QEMU
        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # master
        with:
          platforms: all

      - name: Install cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2

      - name: log in to container registry
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Login to Quay.io
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: quay.io
          username: ${{ secrets.QUAY_USERNAME }}
          password: ${{ secrets.QUAY_ROBOT_TOKEN }}

      - name: Login to GitHub Container Registry
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
        with:
          aws-access-key-id: ${{ secrets.AWS_USR }}
          aws-secret-access-key: ${{ secrets.AWS_PSW }}
          aws-region: us-east-1

      # creating custom env var
      - name: set env
        run: |
          echo "BRANCH_NAME=${GITHUB_REF##*/}" >> "$GITHUB_ENV"
          echo "GITHUB_REF=${GITHUB_REF}" >> "$GITHUB_ENV"

      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: 3.13

      - name: Install dependencies
        run: |
          python3 -m pip install --upgrade pip setuptools wheel
          sudo apt-get -q update
          sudo apt-get -q install -y python3-pygit2

      - name: Configure git user
        run: |
          # Use our Rook "service account"
          git config user.name Rook
          git config user.email "cncf-rook-info@lists.cncf.io"

      - name: build and release
        env:
          GIT_API_TOKEN: ${{ secrets.GIT_API_TOKEN }}
          BRANCH_NAME: ${{ env.BRANCH_NAME }}
          AWS_USR: ${{ secrets.AWS_USR }}
          AWS_PSW: ${{ secrets.AWS_PSW }}
          GITHUB_REF: ${{ env.GITHUB_REF }}
        run: |
          tests/scripts/build-release.sh