pull_request.yaml

name: Deliver Container Image
on:
  pull_request:
    types: [opened, reopened, synchronize]

env:
  IMAGE_NAME: paddock-off
  IMAGE_TAGS: ${{ github.sha }}
  IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }}
  REGISTRY_USER: ${{ github.actor }}
  REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}

permissions:
  contents: read

# https://github.com/pre-commit/action/issues/7#issuecomment-1251300704
#   run only on changed files
jobs:
  build:
    name: build
    runs-on: ubuntu-latest

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
        with:
          egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v3.5.2

      - name: Buildah Action
        id: build_image
        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2.12
        with:
          image: ${{ env.IMAGE_NAME }}
          tags: ${{ env.IMAGE_TAGS }}
          oci: true
          context: components/paddock
          containerfiles: |
            ./components/paddock/Containerfile