name: build
on:
  schedule:
    - cron: '0 3 * * 3'

  workflow_dispatch: {}

  push:
    branches: [ main ]

jobs:
  build:
    strategy:
      matrix:
        variant: [44]

    runs-on: bare-metal

    steps:
      - uses: actions/checkout@v4

      - name: Build
        run: buildah bud -t ${{ vars.OCI_REGISTRY }}/drath/dev-toolbx:${{ matrix.variant }} -f Containerfile .

      - name: Push
        run: |
          echo "${{ secrets.OCI_PASSWD }}" | buildah login ${{ vars.OCI_REGISTRY }} -u gitea --password-stdin
          buildah push ${{ vars.OCI_REGISTRY }}/drath/dev-toolbx:${{ matrix.variant }}
          
      - name: Sign
        env:
          COSIGN_PASSWORD: ${{ secrets.COSIGN_PW }}
        run: |
          echo "${{ secrets.OCI_PASSWD }}" | cosign login ${{ vars.OCI_REGISTRY }} -u gitea --password-stdin
          echo "${{ secrets.COSIGN_KEY }}" > cosign.key
          DIGEST=$(skopeo inspect --creds "gitea:${{ secrets.OCI_PASSWD }}" --format '{{.Digest}}' docker://${{ vars.OCI_REGISTRY }}/drath/dev-toolbx:${{ matrix.variant }})
          cosign sign --yes --key cosign.key "${{ vars.OCI_REGISTRY }}/drath/dev-toolbx@${DIGEST}"