release.yaml

name: Publish Zarf Init Package On Tag

permissions:
  contents: read

on:
  push:
    branches: [ 'main' ]

env:
  # renovate: depName=zarf-dev/zarf
  ZARF_VERSION: 0.45.0

jobs:
  build:
    runs-on: ubuntu-latest

    strategy:
      matrix:
        flavor: [ full, minimal ]

    permissions:
      contents: read
      packages: write

    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0

      - name: "Login to GHCR"
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ github.token }}

      - name: Install tools
        uses: ./.github/actions/install-tools

      - name: Build image
        uses: ./.github/actions/build-image
        env:
          REGISTRY1_USERNAME: ${{ secrets.REGISTRY1_USERNAME }}
          REGISTRY1_PASSWORD: ${{ secrets.REGISTRY1_PASSWORD }}
        with:
          flavor: ${{ matrix.flavor }}

      - name: "Sign and Publish the ${{ matrix.flavor }} image"
        run: |
          zarf package publish build/zarf-init-${{ matrix.flavor }}-amd64-v${ZARF_VERSION}.tar.zst oci://ghcr.io/radiusmethod/zarf-init-bigbang-k3s-ha --signing-key awskms:///alias/zarf-init-bigbang
        env:
          AWS_REGION: ${{ secrets.AWS_REGION }}
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID_GOV }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY_GOV }}