on:
  push:

jobs:
  build-oci-builder:
    name: 'Build oci-builder'
    runs-on: 'oci-builder'

    steps:
      - uses: actions/checkout@v4

      - name: 'Build image'
        uses: 'https://git.uncontrol.me/ver4a-actions/buildah-build@v2-compat'
        with:
          image: 'registry.uncontrol.me/ver4a/oci-builder'
          tags: 'ci-dev'
          containerfiles: 'Dockerfile'
          oci: true
          extra-args: |
            --userns=container
            --security-opt=no-new-privileges
            --annotation=quay.expires-after=
          build-args: |
            REGISTRY_DOMAIN=${{ vars.REGISTRY_DOMAIN }}
            NAMESPACE=${{ vars.NAMESPACE }}

      - name: 'Log in to registry'
        uses: 'actions/podman-login@v1'
        with:
          registry: ${{ vars.REGISTRY_DOMAIN }}
          username: ${{ vars.REGISTRY_USERNAME }}
          password: ${{ secrets.REGISTRY_PASSWORD }}
          auth_file_path: '$HOME/.config/containers/auth.json'

      - name:
        uses: 'actions/push-to-registry@v2'
        with:
          image: 'ver4a/oci-builder'
          tags: 'ci-dev'
          registry: 'registry.uncontrol.me'