image.yaml

---
name: Create OCI image
on:
  pull_request:
    branches:
      - main
  push:
    branches:
      - main

permissions: read-all

jobs:
  publish-image:
    runs-on: large-ubuntu-22.04
    permissions:
      packages: write
      id-token: write
    steps:

      - name: Checkout
        uses: >- # v4.1.1
          actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11

      - name: Install Nix
        uses: >- # v9
          DeterminateSystems/nix-installer-action@cd46bde16ab981b0a7b2dce0574509104543276e
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          nix-installer-tag: v0.16.1

      - name: Cache Nix derivations
        uses: >- # Custom commit, last pinned at 2023-11-17.
          DeterminateSystems/magic-nix-cache-action@a04e6275a6bea232cd04fc6f3cbf20d4cb02a3e1

      - name: Test image
        run: |
          nix run .#local-image-test

      - name: Upload image
        run: |
          nix run .#publish-ghcr
        env:
          GHCR_REGISTRY: ghcr.io
          GHCR_USERNAME: ${{ github.actor }}
          GHCR_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
          GHCR_IMAGE_NAME: ${{ github.repository }}
        if: github.ref == 'refs/heads/main'