velero/.github/workflows/push.yml

name: Main CI

on:
  push:
    branches: [ main ]
    tags:
      - '*'

jobs:

  build:
    name: Build
    runs-on: ubuntu-latest
    steps:

    - name: Set up Go
      uses: actions/setup-go@v2
      with:
        go-version: 1.17
      id: go

    - name: Check out code into the Go module directory
      uses: actions/checkout@v2

    - name: Set up QEMU
      id: qemu
      uses: docker/setup-qemu-action@v1
      with:
        platforms: all

    - name: Set up Docker Buildx
      id: buildx
      uses: docker/setup-buildx-action@v1
      with:
        version: latest

    - name: Build
      run: make local

    - name: Test
      run: make test

    # Only try to publish the container image from the root repo; forks don't have permission to do so and will always get failures.
    - name: Publish container image
      if: github.repository == 'vmware-tanzu/velero'
      run: |
        docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_PASSWORD }}
        ./hack/docker-push.sh

    # actions/checkout MUST come before auth
    - uses: 'actions/checkout@v2'

    # auth to GCP with OIDC token from GCP Workload Identity Provider. Output auth result to access token.
    - id: 'auth'
      name: 'Authenticate to Google Cloud'
      uses: 'google-github-actions/auth@v0.6.0'
      with:
        credentials_json: '${{ secrets.GCR_SA_KEY }}'
        token_format: 'access_token'

    # Use access_token generated above to login gcr.io
    - uses: 'docker/login-action@v1'
      with:
        registry: 'gcr.io' # or REGION.docker.pkg.dev
        username: 'oauth2accesstoken'
        password: '${{ steps.auth.outputs.access_token }}'

    # Push image to GCR to facilitate some environments that have rate limitation to docker hub, e.g. vSphere.
    - name: Publish container image to GCR
      if: github.repository == 'vmware-tanzu/velero'
      run: |
        REGISTRY=gcr.io/velero-gcp ./hack/docker-push.sh