release.yaml

---
name: Release
concurrency: opa-release
on:
    release:
        types:
            - published

permissions:
    contents: read
    id-token: write

jobs:
    publish:
        name: Build and publish docker container to gcr.io and dockerhub
        runs-on: ubuntu-latest
        env:
            ARTIFACT_REGISTRY_URL: europe-west1-docker.pkg.dev
            GCP_PROJECT_ID_MGMT: ${{ secrets.GCP_PROJECT_ID_MGMT }}
            GCR_URL: gcr.io # TODO remove after migration
            GCP_PROJECT_ID: ${{ secrets.GCP_PROJECT_ID }} # TODO remove after migration
            DOCKER_BUILDKIT: 1
        steps:
            -   name: Check out code
                uses: actions/checkout@v4

            -   name: Setup ENV variables
                run: |
                    echo "NOW=$(date -u +%Y-%m-%dT%H:%M:%S)" >> $GITHUB_ENV
                    echo "SHORT_SHA=$(git rev-parse --short HEAD)" >> $GITHUB_ENV
                    echo "VERSION=${{ github.event.release.tag_name }}" >> $GITHUB_ENV

            -   name: Authenticate to Google Cloud
                id: auth
                uses: google-github-actions/auth@v1
                with:
                    workload_identity_provider: projects/699926043561/locations/global/workloadIdentityPools/github-dev/providers/github-dev-provider
                    service_account: opa-indykite-plugin@jarvis-dev-268314.iam.gserviceaccount.com

            -   name: Configure Docker
                run: |-
                    gcloud --quiet auth configure-docker

            -   name: Login to Docker Hub
                uses: docker/login-action@v3
                with:
                    username: ${{ secrets.DOCKERHUB_USERNAME }}
                    password: ${{ secrets.DOCKERHUB_PAT }}

            -   name: Build, Tag and Push docker images
                run: |
                    make opa-ci

            # TODO replace the block above with this after switching to indykite-dev
            -   name: Authenticate to Google Cloud
                id: authentication
                uses: google-github-actions/auth@v2
                with:
                    workload_identity_provider: 'projects/581343830490/locations/global/workloadIdentityPools/github-mgmt/providers/github-mgmt-provider'
                    service_account: "github@${{ env.GCP_PROJECT_ID_MGMT }}.iam.gserviceaccount.com"
            -   name: Configure Docker
                run: |
                    gcloud auth configure-docker $ARTIFACT_REGISTRY_URL -q

            -   name: Build, Tag and Push docker images
                run: |
                    make opa-ci-new

            -   name: Check out notifier action repo
                uses: actions/checkout@v4
                with:
                    ref: master
                    repository: indykite/notifier-action
                    path: notifier-action
                    token: ${{ secrets.INDYKITEONE_PAT }}

            -   name: Trigger new OPA test image build
                uses: ./notifier-action/
                with:
                    image_tag: ${{ env.SHORT_SHA }}
                    token: ${{ secrets.INDYKITEONE_PAT }}
                    owner: indykite
                    repo: jarvis-opa-test
                    workflow_id: dev-build-test-opa.yaml
                    ref: master