publish-schemas.yaml

---
name: "Publish Schemas"

on:
  workflow_dispatch:
  schedule:
    - cron: "0 0 * * 0"
  push:
    branches: ["main"]
    paths: [".github/workflows/publish-schemas.yaml"]

jobs:
  publish-manifests:
    name: Publish Manifests
    runs-on: ["arc-home-ops"]
    steps:
      - name: Setup Flux
        uses: fluxcd/flux2/action@896e0fa46d5107a05e953dd0a5261d78a145ec8c # v2.3.0

      - name: Setup Kube Tools
        uses: yokawasa/action-setup-kube-tools@5fe385031665158529decddddb51d6224422836e # v0.11.1
        with:
          setup-tools: |
            kubectl

      - name: Setup Python
        uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v5.1.1
        with:
          python-version: 3.x

      - name: Login to GitHub Container Registry
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Setup crd-extractor
        uses: robinraju/release-downloader@a96f54c1b5f5e09e47d9504526e96febd949d4c2 # v1.11
        with:
          repository: datreeio/CRDs-catalog
          latest: true
          fileName: crd-extractor.zip

      - name: Write kubeconfig
        id: kubeconfig
        uses: timheuer/base64-to-file@adaa40c0c581f276132199d4cf60afa07ce60eac # v1.2
        with:
          encodedString: ${{ secrets.KUBECONFIG }}
          fileName: kubeconfig

      - name: Run crd-extractor
        env:
          KUBECONFIG: ${{ steps.kubeconfig.outputs.filePath }}
        run: |
          unzip -j $GITHUB_WORKSPACE/crd-extractor.zip -d $GITHUB_WORKSPACE
          bash $GITHUB_WORKSPACE/crd-extractor.sh

      - name: Lowercase Owner Name
        env:
          REPO_OWNER: '${{ github.repository_owner }}'
        run: |
          echo "REPO_OWNER_LC=${REPO_OWNER,,}" >>${GITHUB_ENV}

      - name: Generate tag
        id: generate-tag
        run: echo "tag=ghcr.io/${REPO_OWNER_LC}/manifests/kubernetes-schemas:$(git rev-parse --short HEAD)" >> "${GITHUB_OUTPUT}"

      - name: Publish manifests
        run: |
          flux push artifact oci://${{ steps.generate-tag.outputs.tag }} \
              --path="/home/runner/.datree/crdSchemas" \
              --source="${{ github.repositoryUrl }}" \
              --revision="${{ github.ref_name }}@sha1:$(git rev-parse HEAD)"

      - name: Tag manifests
        run: flux tag artifact oci://${{ steps.generate-tag.outputs.tag }} --tag main

  publish-web:
    name: Publish Web
    runs-on: ubuntu-latest
    needs: ["publish-manifests"]
    steps:
      - name: Setup Flux
        uses: fluxcd/flux2/action@896e0fa46d5107a05e953dd0a5261d78a145ec8c # v2.3.0

      - name: Setup QEMU
        uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3.2.0

      - name: Setup Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@3d68780484996aa9d417bb9016193885cdf1f299 # v3.6.0

      - name: Login to GitHub Container Registry
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Lowercase Owner Name
        env:
          REPO_OWNER: '${{ github.repository_owner }}'
        run: |
          echo "REPO_OWNER_LC=${REPO_OWNER,,}" >>${GITHUB_ENV}

      - name: Pull manifests
        run: |
          mkdir -p /home/runner/crdSchemas
          flux pull artifact oci://ghcr.io/${REPO_OWNER_LC}/manifests/kubernetes-schemas:$(git rev-parse --short HEAD) --output /home/runner/crdSchemas

      - name: Write nginx-unprivileged Dockerfile
        run: |
          cat <<EOF > /home/runner/crdSchemas/Dockerfile
          FROM docker.io/nginxinc/nginx-unprivileged:latest
          COPY --chown=nginx:nginx --chmod=755 . /usr/share/nginx/html
          USER nginx
          EOF

      - name: Publish web container
        uses: docker/build-push-action@5176d81f87c23d6fc96624dfdbcd9f3830bbe445 # v6.5.0
        with:
          context: /home/runner/crdSchemas
          platforms: linux/amd64,linux/arm64
          file: /home/runner/crdSchemas/Dockerfile
          push: true
          tags: |
            ghcr.io/${{ env.REPO_OWNER_LC }}/kubernetes-schemas:latest
          cache-from: type=gha
          cache-to: type=gha,mode=max
          labels: |
            org.opencontainers.image.source="${{ github.repositoryUrl }}"
            org.opencontainers.image.authors="Jeff Davis <jefedavis@users.noreply.github.com>"