publish.yaml

name: release

# triggered when a push is made to the main branch AND either zarf.yaml or zarf-config.yaml are modified
on:
  push:
    branches:
      - main
    paths:
      - "zarf.yaml"
      - "zarf-config.yaml"
  workflow_dispatch:

jobs:
  release:
    runs-on: ubuntu-latest
    permissions:
      # id-token: write # needed for keyless signing
      contents: read
      packages: write # needed for ghcr access
    strategy:
      matrix:
        flavor:
          - registry1
          - gitea-registry1
    steps:
      - uses: actions/checkout@v4
      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Login to registry1
        uses: docker/login-action@v3
        with:
          registry: registry1.dso.mil
          username: ${{ secrets.IRON_BANK_ROBOT_USERNAME }}
          password: ${{ secrets.IRON_BANK_ROBOT_PASSWORD }}
      - name: Install Zarf
        uses: defenseunicorns/setup-zarf@main
        with:
          # renovate: datasource=docker depName=registry1.dso.mil/ironbank/opensource/defenseunicorns/zarf/zarf-agent
          version: v0.34.0
          download-init-package: false
      - name: Build and Publish IB Package
        run: zarf package create --confirm --output oci://ghcr.io/defenseunicorns/delivery-zarf-init --no-progress --flavor ${{ matrix.flavor }}