fleet/.github/workflows/release-fleetctl-docker-deps.yaml

# Builds and releases to production the fleetdm/bomutils:latest and fleetdm/wix:latest
# docker images, which are the docker image dependencies of the fleetctl command.
#
# This is separate from Fleet releases because we only release
# fleetdm/bomutils and fleetdm/wix only if we add new dependencies
# or for security updates.
name: Release fleetctl docker dependencies

on:
  push:
    tags:
      - "fleetctl-docker-deps-*"

# This allows a subsequently queued workflow run to interrupt previous runs
concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id}}
  cancel-in-progress: true

defaults:
  run:
    # fail-fast using bash -eo pipefail. See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference
    shell: bash

permissions:
  contents: read

jobs:
  push_latest:
    runs-on: ubuntu-latest
    environment: Docker Hub
    permissions:
      contents: write
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: Checkout Code
        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3

      - name: Install Go
        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
        with:
          go-version-file: 'go.mod'

      - name: Login to Docker Hub
        uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v2.1.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_ACCESS_TOKEN }}

      - name: Build fleetdm/wix
        run: make wix-docker

      - name: Build fleetdm/bomutils
        run: make bomutils-docker

      #
      # After fleetdm/wix and fleetdm/bomutils are built,
      # let's smoke test pkg/msi generation before pushing.
      #

      - name: Build fleetctl
        run: make fleetctl

      - name: Build MSI
        run: ./build/fleetctl package --type msi --enroll-secret=foo --fleet-url=https://localhost:8080

      - name: Build PKG
        run: ./build/fleetctl package --type pkg --enroll-secret=foo --fleet-url=https://localhost:8080

      #
      # Now push to production
      #

      - name: Push fleetdm/bomutils to docker hub
        run: docker push fleetdm/bomutils:latest

      - name: Push fleetdm/wix to docker hub
        run: docker push fleetdm/wix:latest