name: Update devcontainer image

on:
  schedule:
    - cron: '0 8 * * 1'

  # Allows you to run this workflow manually from the Actions tab
  workflow_dispatch:

env:
  HELM_VERSION: v3.11.1

jobs:
  build-and-push-devcontainer-image:
    runs-on: ubuntu-20.04
    permissions:
      contents: read
      id-token: write
      packages: write

    env:
      COSIGN_EXPERIMENTAL: 1

    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - name: Install cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
        with:
          cosign-release: v2.2.3
      - name: Install regctl
        uses: regclient/actions/regctl-installer@14f9d37db17b5dc41fefd1ffdd1af4b9e2490560 # main
      - name: Log in to GHCR
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Build / Push images
        run: |
          set -e
          cd .devcontainer/
          docker build -t ghcr.io/spiffe/helm-charts-hardened-devcontainer:latest .
          docker push ghcr.io/spiffe/helm-charts-hardened-devcontainer:latest