release.yaml

name: Release
on:
  push:
    tags:
      - "v*"
env:
  GH_USER: aqua-bot
jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Create bundle
        run: make bundle
      - name: Login to GitHub Packages Container registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ env.GH_USER }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Deploy policy bundle to ghcr.io (for backwards compatibility)
        run: |
          tags=(latest ${{ env.RELEASE_VERSION}} ${{env.MINOR_VERSION }} ${{ env.MAJOR_VERSION }})
          for tag in ${tags[@]}; do
              oras push ghcr.io/aquasecurity/trivy-policies:${tag} \
              --config /dev/null:application/vnd.cncf.openpolicyagent.config.v1+json \
              --annotation "org.opencontainers.image.source=$GITHUB_SERVER_URL/$GITHUB_REPOSITORY" \
              --annotation "org.opencontainers.image.revision=$GITHUB_SHA" \
              bundle.tar.gz:application/vnd.cncf.openpolicyagent.layer.v1.tar+gzip
          done
      - name: Deploy checks bundle to ghcr.io
        run: |
          tags=(latest ${{ env.RELEASE_VERSION}} ${{env.MINOR_VERSION }} ${{ env.MAJOR_VERSION }})
          for tag in ${tags[@]}; do
              oras push ghcr.io/${{ github.repository }}:${tag} \
              --config /dev/null:application/vnd.cncf.openpolicyagent.config.v1+json \
              bundle.tar.gz:application/vnd.cncf.openpolicyagent.layer.v1.tar+gzip
          done