image-push.yml

on:
  release:
    types: [published]

permissions:
  contents: read

env:
  GITHUB_ACTION_TAG: ${{ github.ref_name }}

jobs:
  push-multiarch:
    permissions:
      contents: read
      id-token: write
    runs-on: ubuntu-latest
    steps:
    - name: Check out code
      uses: actions/checkout@v4

    - name: Set the TAG value
      id: get-TAG
      run: |
        echo "$(make -s log | grep TAG)" >> "$GITHUB_ENV"

    - name: Set up QEMU
      uses: docker/setup-qemu-action@v3

    - name: "Read secrets"
      uses: rancher-eio/read-vault-secrets@main
      with:
        secrets: |
          secret/data/github/repo/${{ github.repository }}/dockerhub/${{ github.repository_owner }}/credentials username | DOCKER_USERNAME ;
          secret/data/github/repo/${{ github.repository }}/dockerhub/${{ github.repository_owner }}/credentials password | DOCKER_PASSWORD

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3

    - name: Login to Container Registry
      uses: docker/login-action@v3
      with:
        username: ${{ env.DOCKER_USERNAME }}
        password: ${{ env.DOCKER_PASSWORD }}

    - name: Build container image
      uses: docker/build-push-action@v6
      with:
        context: .
        push: true
        tags: rancher/hardened-crictl:${{ github.event.release.tag_name }}
        file: Dockerfile
        platforms: linux/amd64, linux/arm64
        build-args: |
          TAG=${{ env.TAG }}