cd.yml

name: CD

on:
  push:
    branches:
      - master

jobs:
  cd:
    name: Build and Publish
    runs-on: ubuntu-latest
    steps:
      - name: Clone the code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod

      - name: Build operator image
        run: |
          SHA=$(git rev-parse --short HEAD)
          make container-build IMG=quay.io/codeready-toolchain/claw-operator:${SHA}

      - name: Build proxy image
        run: |
          SHA=$(git rev-parse --short HEAD)
          make container-build-proxy PROXY_IMG=quay.io/codeready-toolchain/claw-proxy:${SHA}

      - name: Login to Quay.io
        env:
          QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
          QUAY_TOKEN: ${{ secrets.QUAY_TOKEN }}
        run: |
          set -euo pipefail
          : "${QUAY_USERNAME:?QUAY_USERNAME secret is required}"
          : "${QUAY_TOKEN:?QUAY_TOKEN secret is required}"
          REGISTRY_AUTH_FILE="${RUNNER_TEMP}/containers-auth.json"
          export REGISTRY_AUTH_FILE
          echo "REGISTRY_AUTH_FILE=${REGISTRY_AUTH_FILE}" >> "${GITHUB_ENV}"
          podman login --authfile "${REGISTRY_AUTH_FILE}" \
            -u "${QUAY_USERNAME}" --password-stdin quay.io <<< "${QUAY_TOKEN}"

      - name: Push operator image
        run: |
          SHA=$(git rev-parse --short HEAD)
          make container-push IMG=quay.io/codeready-toolchain/claw-operator:${SHA}

      - name: Push proxy image
        run: |
          SHA=$(git rev-parse --short HEAD)
          make container-push-proxy PROXY_IMG=quay.io/codeready-toolchain/claw-proxy:${SHA}

      - name: Publish staging bundle and catalog
        run: make push-to-quay-staging

      - name: Create Kind cluster for scorecard
        continue-on-error: true
        id: kind
        run: |
          make kind
          bin/kind create cluster --name scorecard

      - name: Wait for cluster ready
        id: cluster_ready
        if: steps.kind.outcome == 'success'
        continue-on-error: true
        run: |
          kubectl wait --for=condition=Ready nodes --all --timeout=60s
          kubectl -n default wait --for=jsonpath='{.metadata.name}'=default serviceaccount/default --timeout=60s

      - name: Run scorecard tests
        if: steps.kind.outcome == 'success' && steps.cluster_ready.outcome == 'success'
        continue-on-error: true
        run: |
          bin/operator-sdk scorecard ./bundle \
            --kubeconfig=$HOME/.kube/config \
            --wait-time=120s \
            --output=text || echo "::warning::Scorecard tests failed (non-blocking)"

      - name: Cleanup Kind cluster
        if: always() && steps.kind.outcome == 'success'
        run: bin/kind delete cluster --name scorecard