name: CI | Publish kata-deploy payload
on:
  workflow_call:
    inputs:
      tarball-suffix:
        required: false
        type: string
      registry:
        required: true
        type: string
      repo:
        required: true
        type: string
      tag:
        required: true
        type: string
      commit-hash:
        required: false
        type: string
      target-branch:
        required: false
        type: string
        default: ""
      runner:
        default: 'ubuntu-22.04'
        description: The runner to execute the workflow on. Defaults to 'ubuntu-22.04'.
        required: false
        type: string
      arch:
        description: The arch of the tarball.
        required: true
        type: string
    secrets:
      QUAY_DEPLOYER_PASSWORD:
        required: true

permissions: {}

jobs:
  kata-payload:
    name: kata-payload
    permissions:
      contents: read
      packages: write
    runs-on: ${{ inputs.runner }}
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          ref: ${{ inputs.commit-hash }}
          fetch-depth: 0
          persist-credentials: false

      - name: Rebase atop of the latest target branch
        run: |
          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
        env:
          TARGET_BRANCH: ${{ inputs.target-branch }}

      - name: get-kata-tarball for ${{ inputs.arch }}
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: kata-static-tarball-${{ inputs.arch}}${{ inputs.tarball-suffix }}

      - name: Login to Kata Containers quay.io
        if: ${{ inputs.registry == 'quay.io' }}
        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
        with:
          registry: quay.io
          username: ${{ vars.QUAY_DEPLOYER_USERNAME }}
          password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}

      - name: Login to Kata Containers ghcr.io
        if: ${{ inputs.registry == 'ghcr.io' }}
        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: build-and-push-kata-payload for ${{ inputs.arch }}
        id: build-and-push-kata-payload
        env:
          REGISTRY: ${{ inputs.registry }}
          REPO: ${{ inputs.repo }}
          TAG: ${{ inputs.tag }}
        run: |
          ./tools/packaging/kata-deploy/local-build/kata-deploy-build-and-upload-payload.sh \
          "$(pwd)/kata-static.tar.zst" \
          "${REGISTRY}/${REPO}" \
          "${TAG}"