schemas.yaml

---
# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
name: "Publish Kubernetes Schemas"

on:
  # Allows manually triggering the workflow from the Github Actions UI
  workflow_dispatch: {}
  # Runs the workflow weekly at midnight (UTC)
  schedule:
    - cron: "0 0 * * 0"
  push:
    branches:
      - "main"
    paths:
      - ".github/workflows/schemas.yaml"

env:
  OCI_REPO: "oci://ghcr.io/szinn/kubernetes-schemas/${{ github.event.repository.name }}"

jobs:
  publish-kubernetes-schemas:
    name: Publish Kubernetes Schemas
    runs-on: ["k8s-homelab"]
    permissions:
      contents: read
      packages: write
    steps:
      - name: Setup Tools
        shell: bash
        run: |
          sudo apt-get -qq update && \
          sudo apt-get -qq install --no-install-recommends -y curl unzip

      - name: Setup Flux CLI
        uses: fluxcd/flux2/action@main
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Setup Kube Tools
        uses: yokawasa/action-setup-kube-tools@dc0754a9a47b40f22f9bd52ffb082bbe6d142b22 # v0.11.0
        with:
          setup-tools: kubectl

      - name: Setup Python
        uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0
        with:
          python-version: "3.11"

      - name: Write kubeconfig
        id: kubeconfig
        uses: timheuer/base64-to-file@adaa40c0c581f276132199d4cf60afa07ce60eac # v1.2
        with:
          encodedString: ${{ secrets.KUBECONFIG }}
          fileName: kubeconfig

      - name: Download and run crd-extractor
        env:
          KUBECONFIG: "${{ steps.kubeconfig.outputs.filePath }}"
        shell: bash
        run: |
          curl -fsSL -o $GITHUB_WORKSPACE/crd-extractor.sh \
              https://raw.githubusercontent.com/datreeio/CRDs-catalog/main/Utilities/crd-extractor.sh
          chmod +x $GITHUB_WORKSPACE/crd-extractor.sh
          bash $GITHUB_WORKSPACE/crd-extractor.sh

      - name: Login to GHCR
        uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20 # v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Publish schemas as OCI
        run: |
          flux push artifact $OCI_REPO:$(git rev-parse --short HEAD) \
              --path="/home/runner/.datree/crdSchemas" \
              --source="${{ github.repositoryUrl }}" \
              --revision="main"

  publish-kubernetes-schemas-web:
    runs-on: ubuntu-latest
    needs: ["publish-kubernetes-schemas"]
    steps:
      - name: Setup Flux CLI
        uses: fluxcd/flux2/action@main
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Setup QEMU
        uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3.0.0

      - name: Setup Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@2b51285047da1547ffb1b2203d8be4c0af6b1f20 # v3.2.0

      - name: Login to GHCR
        uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20 # v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Pull schemas as OCI
        run: |
          mkdir -p /home/runner/crdSchemas
          flux pull artifact $OCI_REPO:$(git rev-parse --short HEAD) --output /home/runner/crdSchemas

      - name: Write nginx-unprivileged Dockerfile
        run: |
          cat <<EOF > /home/runner/crdSchemas/Dockerfile
          FROM docker.io/nginxinc/nginx-unprivileged:latest
          COPY --chown=nginx:nginx --chmod=755 . /usr/share/nginx/html
          USER nginx
          EOF

      - name: Publish schemas as web container
        uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0
        with:
          context: /home/runner/crdSchemas
          platforms: linux/amd64,linux/arm64
          file: /home/runner/crdSchemas/Dockerfile
          push: true
          tags: |
            ghcr.io/szinn/kubernetes-schemas-web:latest
          cache-from: type=gha
          cache-to: type=gha,mode=max
          labels: |
            org.opencontainers.image.source="${{ github.repositoryUrl }}"
            org.opencontainers.image.authors="Scotte Zinn <szinn@users.noreply.github.com>"