open-cluster-management/.github/workflows/post.yml

name: Post

on:
  push:
    paths-ignore:
      - 'solutions/**'
      - 'assets/**'
      - 'troubleshooting/**'
      - ".github/ISSUE_TEMPLATE/*"
    branches:
      - main
  workflow_dispatch: {}

env:
  # Common versions
  GO_VERSION: '1.26'
  GO_REQUIRED_MIN_VERSION: ''

permissions:
  contents: read
  id-token: write
  attestations: write

jobs:
  coverage:
    name: coverage
    runs-on: ubuntu-latest
    steps:
      - name: checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: install Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: ${{ env.GO_VERSION }}
          cache: false
      - name: unit
        run: make test
      - name: report coverage
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v6
        with:
          token: ${{ secrets.CODECOV_UPLOAD_TOKEN }}
          files: ./coverage.out
          flags: unit
          name: unit
          verbose: true
          fail_ci_if_error: true
  images:
    name: images
    runs-on: ubuntu-latest
    strategy:
      matrix:
        arch: [ amd64, arm64 ]
        image-name: [ registration-operator, registration, work, placement, addon-manager ]
    steps:
      - name: checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: install Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: ${{ env.GO_VERSION }}
          cache: false
      - name: install imagebuilder
        run: go install github.com/openshift/imagebuilder/cmd/imagebuilder@v1.2.3
      - name: pull base image
        run: docker pull registry.access.redhat.com/ubi9/ubi-micro:latest --platform=linux/${{ matrix.arch }}
      - name: images
        run: |
          IMAGE_TAG=latest-${{ matrix.arch }} \
          IMAGE_REGISTRY=quay.io/open-cluster-management \
          IMAGE_BUILD_EXTRA_FLAGS="--build-arg OS=linux --build-arg ARCH=${{ matrix.arch }}" \
            make image-${{ matrix.image-name }}
      - name: push
        run: |
          echo ${{ secrets.DOCKER_PASSWORD }} | docker login quay.io --username ${{ secrets.DOCKER_USER }} --password-stdin
          docker push quay.io/open-cluster-management/${{ matrix.image-name }}:latest-${{ matrix.arch }}
          image_digest=$(docker inspect --format='{{index .RepoDigests 0}}' "quay.io/open-cluster-management/${{ matrix.image-name }}:latest-${{ matrix.arch }}" | cut -d'@' -f2)
          echo "IMAGE_DIGEST=${image_digest}" >> $GITHUB_ENV
      - name: Generate SBOM
        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0
        with:
          image: quay.io/open-cluster-management/${{ matrix.image-name }}:latest-${{ matrix.arch }}
          format: 'spdx-json'
          output-file: 'sbom.spdx.json'
      - name: Attest
        uses: actions/attest-sbom@c604332985a26aa8cf1bdc465b92731239ec6b9e # v4
        id: attest
        with:
          subject-name: quay.io/open-cluster-management/${{ matrix.image-name }}
          subject-digest: ${{ env.IMAGE_DIGEST }}
          sbom-path: 'sbom.spdx.json'
          push-to-registry: false
  image-manifest:
    name: image manifest
    runs-on: ubuntu-latest
    strategy:
      matrix:
        image-name: [ registration-operator, registration, work, placement, addon-manager ]
    needs: [ images ]
    steps:
      - name: checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      # Step to install Skopeo
      - name: Install Skopeo and jq
        run: |
          sudo apt-get update
          sudo apt-get install -y skopeo jq
      - name: create
        run: |
          echo ${{ secrets.DOCKER_PASSWORD }} | docker login quay.io --username ${{ secrets.DOCKER_USER }} --password-stdin
          docker manifest create quay.io/open-cluster-management/${{ matrix.image-name }}:latest \
            quay.io/open-cluster-management/${{ matrix.image-name }}:latest-amd64 \
            quay.io/open-cluster-management/${{ matrix.image-name }}:latest-arm64
      - name: annotate
        run: |
          docker manifest annotate quay.io/open-cluster-management/${{ matrix.image-name }}:latest \
            quay.io/open-cluster-management/${{ matrix.image-name }}:latest-amd64 --arch amd64
          docker manifest annotate quay.io/open-cluster-management/${{ matrix.image-name }}:latest \
            quay.io/open-cluster-management/${{ matrix.image-name }}:latest-arm64 --arch arm64
      - name: push
        run: |
          docker manifest push quay.io/open-cluster-management/${{ matrix.image-name }}:latest
          image_digest_latest=$(skopeo inspect docker://quay.io/open-cluster-management/${{ matrix.image-name }}:latest | jq -r '.Digest')
          echo "IMAGE_DIGEST_LATEST=${image_digest_latest}" >> $GITHUB_ENV
      - name: Generate SBOM
        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0
        with:
          image: quay.io/open-cluster-management/${{ matrix.image-name }}:latest
          format: 'spdx-json'
          output-file: 'sbom.spdx.json'
      - name: Attest
        uses: actions/attest-sbom@c604332985a26aa8cf1bdc465b92731239ec6b9e # v4
        id: attest
        with:
          subject-name: quay.io/open-cluster-management/${{ matrix.image-name }}
          subject-digest: ${{ env.IMAGE_DIGEST_LATEST }}
          sbom-path: 'sbom.spdx.json'
          push-to-registry: false
  trigger-clusteradm-e2e:
    needs: [ images, image-manifest ]
    name: trigger clusteradm e2e
    runs-on: ubuntu-latest
    steps:
      - uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4
        with:
          token: ${{ secrets.OCM_BOT_PAT }}
          repository: open-cluster-management-io/clusteradm
          event-type: ocm_changes
          client-payload: '{"ref": "${{ github.ref }}", "sha": "${{ github.sha }}"}'