debian-trust-package-release.yaml

name: debian-trust-package-release
on:
  push:
    branches: ['main']
    paths:
      - make/00_debian_version.mk

jobs:
  build_and_push:
    runs-on: ubuntu-latest

    permissions:
      contents: read # needed for checkout
      packages: write # needed for push images
      id-token: write # needed for keyless signing

    steps:
      - uses: actions/checkout@v4
        # Adding `fetch-depth: 0` makes sure tags are also fetched. We need
        # the tags so `git describe` returns a valid version.
        # see https://github.com/actions/checkout/issues/701 for extra info about this option
        with: { fetch-depth: 0 }

      - id: go-version
        run: |
          make print-go-version >> "$GITHUB_OUTPUT"

      - uses: docker/login-action@v3
        with:
          registry: quay.io
          username: ${{ secrets.QUAY_USERNAME }}
          password: ${{ secrets.QUAY_PASSWORD }}

      - uses: actions/setup-go@v5
        with:
          go-version: ${{ steps.go-version.outputs.result }}

      - id: release
        run: make release-debian-trust-package

    outputs:
      RELEASE_OCI_MANAGER_IMAGE: ${{ steps.release.outputs.RELEASE_OCI_MANAGER_IMAGE }}
      RELEASE_OCI_MANAGER_TAG: ${{ steps.release.outputs.RELEASE_OCI_MANAGER_TAG }}