kata-containers/.github/workflows/payload-after-push.yaml

name: CI | Publish Kata Containers payload
on:
  push:
    branches:
      - main
  workflow_dispatch:

permissions: {}

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}

jobs:
  build-assets-amd64:
    permissions:
      contents: read
      packages: write # needed to push build artifacts to ghcr.io
      id-token: write # needed to sign images and generate attestations
      attestations: write # needed to generate artifact attestations
    uses: ./.github/workflows/build-kata-static-tarball-amd64.yaml
    with:
      commit-hash: ${{ github.sha }}
      push-to-registry: yes
      target-branch: ${{ github.ref_name }}
    secrets:
      QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
      KBUILD_SIGN_PIN: ${{ secrets.KBUILD_SIGN_PIN }}

  build-assets-arm64:
    permissions:
      contents: read
      packages: write # needed to push build artifacts to ghcr.io
      id-token: write # needed to sign images and generate attestations
      attestations: write # needed to generate artifact attestations
    uses: ./.github/workflows/build-kata-static-tarball-arm64.yaml
    with:
      commit-hash: ${{ github.sha }}
      push-to-registry: yes
      target-branch: ${{ github.ref_name }}
    secrets:
      QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
      KBUILD_SIGN_PIN: ${{ secrets.KBUILD_SIGN_PIN }}

  build-assets-s390x:
    permissions:
      contents: read
      packages: write # needed to push build artifacts to ghcr.io
      id-token: write # needed to sign images and generate attestations
      attestations: write # needed to generate artifact attestations
    uses: ./.github/workflows/build-kata-static-tarball-s390x.yaml
    with:
      commit-hash: ${{ github.sha }}
      push-to-registry: yes
      target-branch: ${{ github.ref_name }}
    secrets:
      QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}

  build-assets-ppc64le:
    permissions:
      contents: read
      packages: write # needed to push build artifacts to ghcr.io
    uses: ./.github/workflows/build-kata-static-tarball-ppc64le.yaml
    with:
      commit-hash: ${{ github.sha }}
      push-to-registry: yes
      target-branch: ${{ github.ref_name }}
    secrets:
      QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}

  publish-kata-deploy-image-amd64:
    needs: build-assets-amd64
    permissions:
      contents: read
      packages: write # needed to push build artifacts to ghcr.io
    uses: ./.github/workflows/publish-kata-images.yaml
    with:
      commit-hash: ${{ github.sha }}
      registry: quay.io
      repo: kata-containers/kata-deploy-ci
      tag: kata-containers-latest-amd64
      target-branch: ${{ github.ref_name }}
      runner: ubuntu-22.04
      arch: amd64
      image-kind: deploy
    secrets:
      QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}

  publish-kata-deploy-image-arm64:
    needs: build-assets-arm64
    permissions:
      contents: read
      packages: write # needed to push build artifacts to ghcr.io
    uses: ./.github/workflows/publish-kata-images.yaml
    with:
      commit-hash: ${{ github.sha }}
      registry: quay.io
      repo: kata-containers/kata-deploy-ci
      tag: kata-containers-latest-arm64
      target-branch: ${{ github.ref_name }}
      runner: ubuntu-24.04-arm
      arch: arm64
      image-kind: deploy
    secrets:
      QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}

  publish-kata-deploy-image-s390x:
    needs: build-assets-s390x
    permissions:
      contents: read
      packages: write # needed to push build artifacts to ghcr.io
    uses: ./.github/workflows/publish-kata-images.yaml
    with:
      commit-hash: ${{ github.sha }}
      registry: quay.io
      repo: kata-containers/kata-deploy-ci
      tag: kata-containers-latest-s390x
      target-branch: ${{ github.ref_name }}
      runner: ubuntu-24.04-s390x
      arch: s390x
      image-kind: deploy
    secrets:
      QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}

  publish-kata-deploy-image-ppc64le:
    needs: build-assets-ppc64le
    permissions:
      contents: read
      packages: write # needed to push build artifacts to ghcr.io
    uses: ./.github/workflows/publish-kata-images.yaml
    with:
      commit-hash: ${{ github.sha }}
      registry: quay.io
      repo: kata-containers/kata-deploy-ci
      tag: kata-containers-latest-ppc64le
      target-branch: ${{ github.ref_name }}
      runner: ubuntu-24.04-ppc64le
      arch: ppc64le
      image-kind: deploy
    secrets:
      QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}

  publish-kata-monitor-image-amd64:
    needs: build-assets-amd64
    permissions:
      contents: read
      packages: write # needed to push build artifacts to ghcr.io
    uses: ./.github/workflows/publish-kata-images.yaml
    with:
      commit-hash: ${{ github.sha }}
      registry: quay.io
      repo: kata-containers/kata-monitor-ci
      tag: kata-monitor-latest-amd64
      target-branch: ${{ github.ref_name }}
      runner: ubuntu-22.04
      arch: amd64
      image-kind: monitor
    secrets:
      QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}

  publish-kata-monitor-image-arm64:
    needs: build-assets-arm64
    permissions:
      contents: read
      packages: write # needed to push build artifacts to ghcr.io
    uses: ./.github/workflows/publish-kata-images.yaml
    with:
      commit-hash: ${{ github.sha }}
      registry: quay.io
      repo: kata-containers/kata-monitor-ci
      tag: kata-monitor-latest-arm64
      target-branch: ${{ github.ref_name }}
      runner: ubuntu-24.04-arm
      arch: arm64
      image-kind: monitor
    secrets:
      QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}

  publish-kata-monitor-image-s390x:
    needs: build-assets-s390x
    permissions:
      contents: read
      packages: write # needed to push build artifacts to ghcr.io
    uses: ./.github/workflows/publish-kata-images.yaml
    with:
      commit-hash: ${{ github.sha }}
      registry: quay.io
      repo: kata-containers/kata-monitor-ci
      tag: kata-monitor-latest-s390x
      target-branch: ${{ github.ref_name }}
      runner: ubuntu-24.04-s390x
      arch: s390x
      image-kind: monitor
    secrets:
      QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}

  publish-kata-monitor-image-ppc64le:
    needs: build-assets-ppc64le
    permissions:
      contents: read
      packages: write # needed to push build artifacts to ghcr.io
    uses: ./.github/workflows/publish-kata-images.yaml
    with:
      commit-hash: ${{ github.sha }}
      registry: quay.io
      repo: kata-containers/kata-monitor-ci
      tag: kata-monitor-latest-ppc64le
      target-branch: ${{ github.ref_name }}
      runner: ubuntu-24.04-ppc64le
      arch: ppc64le
      image-kind: monitor
    secrets:
      QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}

  publish-manifest:
    name: publish-manifest
    runs-on: ubuntu-22.04
    permissions:
      contents: read
      packages: write # needed to push manifest images to ghcr.io
    needs: [publish-kata-deploy-image-amd64, publish-kata-deploy-image-arm64, publish-kata-deploy-image-s390x, publish-kata-deploy-image-ppc64le]
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Login to Kata Containers quay.io
        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
        with:
          registry: quay.io
          username: ${{ vars.QUAY_DEPLOYER_USERNAME }}
          password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}

      - name: Push multi-arch manifest
        run: |
          ./tools/packaging/release/release.sh publish-multiarch-manifest
        env:
          KATA_DEPLOY_IMAGE_TAGS: "kata-containers-latest"
          KATA_DEPLOY_REGISTRIES: "quay.io/kata-containers/kata-deploy-ci"

  publish-kata-monitor-manifest:
    name: publish-kata-monitor-manifest
    runs-on: ubuntu-22.04
    permissions:
      contents: read
      packages: write # needed to push manifest images to ghcr.io
    needs: [publish-kata-monitor-image-amd64, publish-kata-monitor-image-arm64, publish-kata-monitor-image-s390x, publish-kata-monitor-image-ppc64le]
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Login to Kata Containers ghcr.io
        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Login to Kata Containers quay.io
        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
        with:
          registry: quay.io
          username: ${{ vars.QUAY_DEPLOYER_USERNAME }}
          password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}

      - name: Push multi-arch monitor manifest
        run: |
          # kata-monitor has no job-dispatcher sidecar image, so opt out of the
          # kata-deploy-specific dispatcher manifest derivation.
          ./tools/packaging/release/release.sh publish-multiarch-manifest
        env:
          KATA_DEPLOY_IMAGE_TAGS: "kata-monitor-latest"
          KATA_DEPLOY_REGISTRIES: "quay.io/kata-containers/kata-monitor-ci ghcr.io/${{ github.repository_owner }}/kata-monitor-ci"
          KATA_DEPLOY_PUBLISH_JOB_DISPATCHER: "false"

  upload-helm-chart-tarball:
    name: upload-helm-chart-tarball
    needs: publish-manifest
    runs-on: ubuntu-22.04
    permissions:
      packages: write # needed to push the helm chart to ghcr.io
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Install helm
        uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4.2.0
        id: install

      - name: Login to the OCI registries
        env:
          QUAY_DEPLOYER_USERNAME: ${{ vars.QUAY_DEPLOYER_USERNAME }}
          QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
          GITHUB_TOKEN: ${{ github.token }}
        run: |
          echo "${QUAY_DEPLOYER_PASSWORD}" | helm registry login quay.io --username "${QUAY_DEPLOYER_USERNAME}" --password-stdin
          echo "${GITHUB_TOKEN}" | helm registry login ghcr.io --username "${GITHUB_ACTOR}" --password-stdin

      - name: Push helm chart to the OCI registries
        run: |
          ./tools/packaging/kata-deploy/local-build/kata-deploy-build-and-upload-helm-chart.sh \
            quay.io/kata-containers/kata-deploy-ci \
            kata-containers-latest \
            quay.io/kata-containers/kata-deploy-charts \
            0.0.0-dev
          ./tools/packaging/kata-deploy/local-build/kata-deploy-build-and-upload-helm-chart.sh \
            quay.io/kata-containers/kata-deploy-ci \
            kata-containers-latest \
            ghcr.io/kata-containers/kata-deploy-charts \
            0.0.0-dev