auricom-home-cluster/.github/workflows/publish-schemas.yaml

---
name: "Publish Schemas"

on:
  workflow_dispatch:
  schedule:
    - cron: "0 0 * * 0"
  push:
    branches: ["main"]
    paths: [".github/workflows/publish-schemas.yaml"]

jobs:
  publish-manifests:
    name: Publish Manifests
    runs-on: ["arc-runner-set-home-ops"]
    steps:
      - name: Setup Flux
        uses: fluxcd/flux2/action@9b3162495ce1b99b1fcdf137c553f543eafe3ec7 # v2.0.1

      - name: Setup Kube Tools
        uses: yokawasa/action-setup-kube-tools@af4ebb1af1efd30c5bd84a2e9773355ad6362a33 # v0.9.3
        with:
          setup-tools: kubectl

      - name: Setup Python
        uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4.7.0
        with:
          python-version: 3.x

      - name: Login to GitHub Container Registry
        uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2.2.0
        with:
          registry: ghcr.io
          username: "${{ github.actor }}"
          password: "${{ secrets.GITHUB_TOKEN }}"

      - name: Setup crd-extractor
        uses: robinraju/release-downloader@efa4cd07bd0195e6cc65e9e30c251b49ce4d3e51 # v1.8
        with:
          repository: datreeio/CRDs-catalog
          latest: true
          fileName: crd-extractor.zip

      - name: Write kubeconfig
        id: kubeconfig
        uses: timheuer/base64-to-file@ca9e30baf83f7f26708fb0059af9a0973fe5f27e # v1.2
        with:
          encodedString: ${{ secrets.KUBECONFIG }}
          fileName: kubeconfig

      - name: Run crd-extractor
        env:
          KUBECONFIG: ${{ steps.kubeconfig.outputs.filePath }}
        shell: bash
        run: |
          unzip -j $GITHUB_WORKSPACE/crd-extractor.zip -d $GITHUB_WORKSPACE
          bash $GITHUB_WORKSPACE/crd-extractor.sh

      - name: Generate tag
        id: generate-tag
        shell: bash
        run: echo "tag=ghcr.io/${{ github.repository_owner }}/manifests/kubernetes-schemas:$(git rev-parse --short HEAD)" >> "${GITHUB_OUTPUT}"

      - name: Publish manifests
        shell: bash
        run: |
          flux push artifact oci://${{ steps.generate-tag.outputs.tag }} \
              --path="/home/runner/.datree/crdSchemas" \
              --source="${{ github.repositoryUrl }}" \
              --revision="${{ github.ref_name }}@sha1:$(git rev-parse HEAD)"

      - name: Tag manifests
        shell: bash
        run: flux tag artifact oci://${{ steps.generate-tag.outputs.tag }} --tag main

  publish-web:
    name: Publish Web
    runs-on: ubuntu-latest
    needs: ["publish-manifests"]
    steps:
      - name: Setup Flux
        uses: fluxcd/flux2/action@9b3162495ce1b99b1fcdf137c553f543eafe3ec7 # v2.0.1

      - name: Setup QEMU
        uses: docker/setup-qemu-action@2b82ce82d56a2a04d2637cd93a637ae1b359c0a7 # v2.2.0

      - name: Setup Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@4c0219f9ac95b02789c1075625400b2acbff50b1 # v2.9.1

      - name: Login to GitHub Container Registry
        uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2.2.0
        with:
          registry: ghcr.io
          username: "${{ github.actor }}"
          password: "${{ secrets.GITHUB_TOKEN }}"

      - name: Pull manifests
        shell: bash
        run: |
          mkdir -p /home/runner/crdSchemas
          flux pull artifact oci://ghcr.io/${{ github.repository_owner }}/manifests/kubernetes-schemas:$(git rev-parse --short HEAD) --output /home/runner/crdSchemas

      - name: Write nginx-unprivileged Dockerfile
        shell: bash
        run: |
          cat <<EOF > /home/runner/crdSchemas/Dockerfile
          FROM docker.io/nginxinc/nginx-unprivileged:latest
          COPY --chown=nginx:nginx --chmod=755 . /usr/share/nginx/html
          USER nginx
          EOF

      - name: Publish web container
        uses: docker/build-push-action@2eb1c1961a95fc15694676618e422e8ba1d63825 # v4.1.1
        with:
          context: /home/runner/crdSchemas
          platforms: linux/amd64,linux/arm64
          file: /home/runner/crdSchemas/Dockerfile
          push: true
          tags: |
            ghcr.io/${{ github.repository_owner }}/kubernetes-schemas:latest
          cache-from: type=gha
          cache-to: type=gha,mode=max
          labels: |
            org.opencontainers.image.source="${{ github.repositoryUrl }}"
            org.opencontainers.image.authors="Auricom <auricomp@users.noreply.github.com>"