# Build the standalone CLI container when a cli-v* tag is pushed.
name: CLI Container

on:
  push:
    tags:
      - "cli-v*"
  workflow_dispatch:

permissions:
  contents: read
  packages: write
  id-token: write

concurrency:
  group: cli-container-${{ github.ref }}
  cancel-in-progress: false

jobs:
  image:
    name: Build CLI image
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Clean version
        id: version
        shell: bash
        run: echo "clean=${GITHUB_REF_NAME#cli-v}" >> "$GITHUB_OUTPUT"
      - uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4
      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
      - uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - id: build
        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7
        with:
          context: cli
          file: cli/Dockerfile
          platforms: linux/amd64,linux/arm64
          push: true
          build-args: |
            VERSION=${{ steps.version.outputs.clean }}
          tags: |
            ghcr.io/victornagibator/pg_integrity_checksums-cli:${{ github.ref_name }}
            ghcr.io/victornagibator/pg_integrity_checksums-cli:latest

      - uses: sigstore/cosign-installer@756fe2d284c7292c4e9b62c8a28f1e5629c59532 # v4.1.3

      - name: Sign CLI image
        run: cosign sign --yes "ghcr.io/victornagibator/pg_integrity_checksums-cli@${{ steps.build.outputs.digest }}"