blue-build 0.9.35

on:
  workflow_call:
    inputs:
      ref:
        required: true
        type: string
      repo:
        required: true
        type: string
      pr_event_number:
        type: string
    secrets:
      TEST_SIGNING_SECRET:
        required: true
        description: The cosign private key used to sign images for tests
env:
  FORCE_COLOR: 1
  CLICOLOR_FORCE: 1
  RUST_LOG_STYLE: always

permissions: {}

jobs:
  test:
    timeout-minutes: 40
    runs-on: ubuntu-latest

    steps:
      - uses: earthly/actions-setup@43211c7a0eae5344d6d79fb4aaf209c8f8866203 # v1.0.13
        with:
          use-cache: false

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          fetch-depth: 0
          ref: ${{ inputs.ref }}
          repository: ${{ inputs.repo }}

      - name: Run build
        id: build
        run: |
          earthly --ci +test

  lint:
    timeout-minutes: 40
    runs-on: ubuntu-latest

    steps:
      - uses: earthly/actions-setup@43211c7a0eae5344d6d79fb4aaf209c8f8866203 # v1.0.13
        with:
          use-cache: false

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          fetch-depth: 0
          ref: ${{ inputs.ref }}
          repository: ${{ inputs.repo }}


      - name: Run build
        id: build
        run: |
          earthly --ci +lint

  integration-tests:
    permissions:
      packages: write # needed to write integ test packages
    timeout-minutes: 60
    runs-on: ubuntu-latest

    steps:
      - name: Maximize build space
        uses: ublue-os/remove-unwanted-software@cc0becac701cf642c8f0a6613bbdaf5dc36b259e # v9

      - uses: earthly/actions-setup@43211c7a0eae5344d6d79fb4aaf209c8f8866203 # v1.0.13
        with:
          use-cache: false

      # Setup repo and add caching
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          fetch-depth: 0
          ref: ${{ inputs.ref }}
          repository: ${{ inputs.repo }}


      - name: Run integration tests
        run: |
          earthly bootstrap
          earthly --ci -P ./integration-tests+all

  docker-build:
    timeout-minutes: 60
    runs-on: ubuntu-latest
    permissions:
      contents: read # read repo contents
      packages: write # write test package to ghcr
      id-token: write # docker auth

    steps:
      - name: Maximize build space
        uses: ublue-os/remove-unwanted-software@cc0becac701cf642c8f0a6613bbdaf5dc36b259e # v9

      - uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
        with:
          install: true

      - uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c # v1.15.2

      # Setup repo and add caching
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          fetch-depth: 0
          ref: ${{ inputs.ref }}
          repository: ${{ inputs.repo }}

      - uses: extractions/setup-just@f8a3cce218d9f83db3a2ecd90e41ac3de6cdfd9b # v3

      - name: Run Build
        env:
          GH_TOKEN: ${{ github.token }}
          GH_PR_EVENT_NUMBER: ${{ inputs.pr_event_number }}
          COSIGN_PRIVATE_KEY: ${{ secrets.TEST_SIGNING_SECRET }}
        run: just test-docker-build

  empty-files-build:
    timeout-minutes: 60
    runs-on: ubuntu-latest
    permissions:
      contents: read # read repo contents
      packages: write # write test package to ghcr
      id-token: write # docker auth

    steps:
      - name: Maximize build space
        uses: ublue-os/remove-unwanted-software@cc0becac701cf642c8f0a6613bbdaf5dc36b259e # v9

      - uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
        with:
          install: true

      - uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c # v1.15.2

      # Setup repo and add caching
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          fetch-depth: 0
          ref: ${{ inputs.ref }}
          repository: ${{ inputs.repo }}


      - uses: extractions/setup-just@f8a3cce218d9f83db3a2ecd90e41ac3de6cdfd9b # v3

      - name: Run Build
        env:
          GH_TOKEN: ${{ github.token }}
          GH_PR_EVENT_NUMBER: ${{ inputs.pr_event_number }}
          COSIGN_PRIVATE_KEY: ${{ secrets.TEST_SIGNING_SECRET }}
        run: just test-empty-files-build

  bluefin-build:
    timeout-minutes: 60
    runs-on: ubuntu-latest
    permissions:
      contents: read # read repo contents
      packages: write # write test package to ghcr
      id-token: write # docker auth

    steps:
      - name: Maximize build space
        uses: ublue-os/remove-unwanted-software@cc0becac701cf642c8f0a6613bbdaf5dc36b259e # v9

      - uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
        with:
          install: true

      - uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c # v1.15.2

      # Setup repo and add caching
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          fetch-depth: 0
          ref: ${{ inputs.ref }}
          repository: ${{ inputs.repo }}


      - uses: extractions/setup-just@f8a3cce218d9f83db3a2ecd90e41ac3de6cdfd9b # v3

      - name: Run Build
        env:
          GH_TOKEN: ${{ github.token }}
          GH_PR_EVENT_NUMBER: ${{ inputs.pr_event_number }}
          COSIGN_PRIVATE_KEY: ${{ secrets.TEST_SIGNING_SECRET }}
        run: just test-bluefin-build

  build-chunked-oci-build:
    timeout-minutes: 40
    runs-on: ubuntu-24.04
    permissions:
      contents: read # read repo contents
      packages: write # write test package to ghcr
      id-token: write # docker auth

    steps:
      - name: Maximize build space
        uses: ublue-os/remove-unwanted-software@cc0becac701cf642c8f0a6613bbdaf5dc36b259e # v9

      - uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
        with:
          install-dir: /usr/bin
          use-sudo: true

      - uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c # v1.15.2

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          fetch-depth: 0
          ref: ${{ inputs.ref }}
          repository: ${{ inputs.repo }}


      - uses: extractions/setup-just@f8a3cce218d9f83db3a2ecd90e41ac3de6cdfd9b # v3

      - name: Run Build
        env:
          GH_TOKEN: ${{ github.token }}
          GH_PR_EVENT_NUMBER: ${{ inputs.pr_event_number }}
          COSIGN_PRIVATE_KEY: ${{ secrets.TEST_SIGNING_SECRET }}
        run: |
          export CARGO_HOME=$HOME/.cargo
          just test-build-chunked-oci-build

  rechunk-build:
    timeout-minutes: 40
    runs-on: ubuntu-24.04
    permissions:
      contents: read # read repo contents
      packages: write # write test package to ghcr
      id-token: write # docker auth

    steps:
      - name: Maximize build space
        uses: ublue-os/remove-unwanted-software@cc0becac701cf642c8f0a6613bbdaf5dc36b259e # v9

      - uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
        with:
          install-dir: /usr/bin
          use-sudo: true

      - uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c # v1.15.2

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          fetch-depth: 0
          ref: ${{ inputs.ref }}
          repository: ${{ inputs.repo }}


      - uses: extractions/setup-just@f8a3cce218d9f83db3a2ecd90e41ac3de6cdfd9b # v3

      - name: Run Build
        env:
          GH_TOKEN: ${{ github.token }}
          GH_PR_EVENT_NUMBER: ${{ inputs.pr_event_number }}
          COSIGN_PRIVATE_KEY: ${{ secrets.TEST_SIGNING_SECRET }}
        run: |
          export CARGO_HOME=$HOME/.cargo
          just test-fresh-rechunk-build
          just test-rechunk-build

  arm64-build:
    timeout-minutes: 90
    runs-on: ubuntu-24.04-arm
    # runs-on: ubuntu-latest
    permissions:
      contents: read # read repo contents
      packages: write # write test package to ghcr
      id-token: write # docker auth

    steps:
      - name: Maximize build space
        uses: ublue-os/remove-unwanted-software@cc0becac701cf642c8f0a6613bbdaf5dc36b259e # v9

      - name: Set up QEMU
        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0

      - uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
        with:
          install: true

      - uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c # v1.15.2

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          fetch-depth: 0
          ref: ${{ inputs.ref }}
          repository: ${{ inputs.repo }}


      - uses: extractions/setup-just@f8a3cce218d9f83db3a2ecd90e41ac3de6cdfd9b # v3

      - name: Run Build
        env:
          GH_TOKEN: ${{ github.token }}
          GH_PR_EVENT_NUMBER: ${{ inputs.pr_event_number }}
          COSIGN_PRIVATE_KEY: ${{ secrets.TEST_SIGNING_SECRET }}
        run: just test-arm64-build

  docker-build-external-login:
    timeout-minutes: 60
    runs-on: ubuntu-latest
    permissions:
      contents: read # read repo contents
      packages: write # write test package to ghcr
      id-token: write # docker auth

    steps:
      - name: Maximize build space
        uses: ublue-os/remove-unwanted-software@cc0becac701cf642c8f0a6613bbdaf5dc36b259e # v9

      - uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
        with:
          install: true

      - name: Docker Login
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        if: inputs.repo == 'blue-build/cli'
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ github.token }}


      - uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c # v1.15.2

      # Setup repo and add caching
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          fetch-depth: 0
          ref: ${{ inputs.ref }}
          repository: ${{ inputs.repo }}



      - uses: extractions/setup-just@f8a3cce218d9f83db3a2ecd90e41ac3de6cdfd9b # v3

      - name: Run Build
        env:
          GH_TOKEN: ${{ github.token }}
          GH_PR_EVENT_NUMBER: ${{ inputs.pr_event_number }}
          COSIGN_PRIVATE_KEY: ${{ secrets.TEST_SIGNING_SECRET }}
        run: just test-docker-build-external-login

  podman-build:
    timeout-minutes: 60
    runs-on: ubuntu-latest
    permissions:
      contents: read # read repo contents
      packages: write # write test package to ghcr
      id-token: write # docker auth

    steps:
      - name: Maximize build space
        uses: ublue-os/remove-unwanted-software@cc0becac701cf642c8f0a6613bbdaf5dc36b259e # v9

      - uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0

      - uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c # v1.15.2

      # Setup repo and add caching
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          fetch-depth: 0
          ref: ${{ inputs.ref }}
          repository: ${{ inputs.repo }}



      - uses: extractions/setup-just@f8a3cce218d9f83db3a2ecd90e41ac3de6cdfd9b # v3

      - name: Run Build
        env:
          GH_TOKEN: ${{ github.token }}
          GH_PR_EVENT_NUMBER: ${{ inputs.pr_event_number }}
          COSIGN_PRIVATE_KEY: ${{ secrets.TEST_SIGNING_SECRET }}
        run: just test-podman-build

  buildah-build:
    timeout-minutes: 60
    runs-on: ubuntu-latest
    permissions:
      contents: read # read repo contents
      packages: write # write test package to ghcr
      id-token: write # docker auth

    steps:
      - name: Maximize build space
        uses: ublue-os/remove-unwanted-software@cc0becac701cf642c8f0a6613bbdaf5dc36b259e # v9

      - uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0

      - uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c # v1.15.2

      # Setup repo and add caching
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          fetch-depth: 0
          ref: ${{ inputs.ref }}
          repository: ${{ inputs.repo }}



      - uses: extractions/setup-just@f8a3cce218d9f83db3a2ecd90e41ac3de6cdfd9b # v3

      - name: Run Build
        env:
          GH_TOKEN: ${{ github.token }}
          GH_PR_EVENT_NUMBER: ${{ inputs.pr_event_number }}
          COSIGN_PRIVATE_KEY: ${{ secrets.TEST_SIGNING_SECRET }}
        run: just test-buildah-build

  multi-platform-docker:
    timeout-minutes: 90
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      id-token: write

    steps:
      - name: Maximize build space
        uses: ublue-os/remove-unwanted-software@cc0becac701cf642c8f0a6613bbdaf5dc36b259e # v9

      - name: Set up QEMU
        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0

      - uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
        with:
          install: true

      - uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c # v1.15.2

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          fetch-depth: 0
          ref: ${{ inputs.ref }}
          repository: ${{ inputs.repo }}


      - uses: extractions/setup-just@f8a3cce218d9f83db3a2ecd90e41ac3de6cdfd9b # v1

      - name: Run Build
        env:
          GH_TOKEN: ${{ github.token }}
          GH_PR_EVENT_NUMBER: ${{ inputs.pr_event_number }}
          COSIGN_PRIVATE_KEY: ${{ secrets.TEST_SIGNING_SECRET }}
        run: just test-multiplatform-docker

  multi-platform-podman:
    timeout-minutes: 90
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      id-token: write

    steps:
      - name: Maximize build space
        uses: ublue-os/remove-unwanted-software@cc0becac701cf642c8f0a6613bbdaf5dc36b259e # v9

      - name: Set up QEMU
        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0

      - uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0

      - uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c # v1.15.2

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          fetch-depth: 0
          ref: ${{ inputs.ref }}
          repository: ${{ inputs.repo }}


      - uses: extractions/setup-just@f8a3cce218d9f83db3a2ecd90e41ac3de6cdfd9b # v1

      - name: Run Build
        env:
          GH_TOKEN: ${{ github.token }}
          GH_PR_EVENT_NUMBER: ${{ inputs.pr_event_number }}
          COSIGN_PRIVATE_KEY: ${{ secrets.TEST_SIGNING_SECRET }}
        run: just test-multiplatform-podman

  multi-platform-buildah:
    timeout-minutes: 90
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      id-token: write

    steps:
      - name: Maximize build space
        uses: ublue-os/remove-unwanted-software@cc0becac701cf642c8f0a6613bbdaf5dc36b259e # v9

      - name: Set up QEMU
        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0

      - uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0

      - uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c # v1.15.2

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          fetch-depth: 0
          ref: ${{ inputs.ref }}
          repository: ${{ inputs.repo }}


      - uses: extractions/setup-just@f8a3cce218d9f83db3a2ecd90e41ac3de6cdfd9b # v1

      - name: Run Build
        env:
          GH_TOKEN: ${{ github.token }}
          GH_PR_EVENT_NUMBER: ${{ inputs.pr_event_number }}
          COSIGN_PRIVATE_KEY: ${{ secrets.TEST_SIGNING_SECRET }}
        run: just test-multiplatform-buildah

  multi-platform-build-chunked-oci:
    timeout-minutes: 120
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      id-token: write

    steps:
      - name: Maximize build space
        uses: ublue-os/remove-unwanted-software@cc0becac701cf642c8f0a6613bbdaf5dc36b259e # v9

      - name: Set up QEMU
        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0

      - uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0

      - uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c # v1.15.2

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          fetch-depth: 0
          ref: ${{ inputs.ref }}
          repository: ${{ inputs.repo }}


      - uses: extractions/setup-just@f8a3cce218d9f83db3a2ecd90e41ac3de6cdfd9b # v1

      - name: Run Build
        env:
          GH_TOKEN: ${{ github.token }}
          GH_PR_EVENT_NUMBER: ${{ inputs.pr_event_number }}
          COSIGN_PRIVATE_KEY: ${{ secrets.TEST_SIGNING_SECRET }}
        run: just test-multiplatform-build-chunked-oci

  multi-platform-rechunk:
    timeout-minutes: 120
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      id-token: write

    steps:
      - name: Maximize build space
        uses: ublue-os/remove-unwanted-software@cc0becac701cf642c8f0a6613bbdaf5dc36b259e # v9

      - name: Set up QEMU
        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0

      - uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0

      - uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c # v1.15.2

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          fetch-depth: 0
          ref: ${{ inputs.ref }}
          repository: ${{ inputs.repo }}


      - uses: extractions/setup-just@f8a3cce218d9f83db3a2ecd90e41ac3de6cdfd9b # v1

      - name: Run Build
        env:
          GH_TOKEN: ${{ github.token }}
          GH_PR_EVENT_NUMBER: ${{ inputs.pr_event_number }}
          COSIGN_PRIVATE_KEY: ${{ secrets.TEST_SIGNING_SECRET }}
        run: just test-multiplatform-rechunk

  iso-from-image:
    timeout-minutes: 60
    runs-on: ubuntu-latest
    permissions:
      contents: read # read repo contents
      packages: write # write test package to ghcr
      id-token: write # docker auth

    steps:
      - name: Maximize build space
        uses: ublue-os/remove-unwanted-software@cc0becac701cf642c8f0a6613bbdaf5dc36b259e # v9

      - uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
        with:
          install: true

      - uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c # v1.15.2

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          fetch-depth: 0
          ref: ${{ inputs.ref }}
          repository: ${{ inputs.repo }}


      - uses: extractions/setup-just@f8a3cce218d9f83db3a2ecd90e41ac3de6cdfd9b # v3

      - name: Run Build
        env:
          GH_TOKEN: ${{ github.token }}
          GH_PR_EVENT_NUMBER: ${{ inputs.pr_event_number }}
          COSIGN_PRIVATE_KEY: ${{ secrets.TEST_SIGNING_SECRET }}
        run: just test-generate-iso-image

  iso-from-image-web-ui:
    timeout-minutes: 60
    runs-on: ubuntu-latest
    permissions:
      contents: read # read repo contents
      packages: write # write test package to ghcr
      id-token: write # docker auth

    steps:
      - name: Maximize build space
        uses: ublue-os/remove-unwanted-software@cc0becac701cf642c8f0a6613bbdaf5dc36b259e # v9

      - uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
        with:
          install: true

      - uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c # v1.15.2

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          fetch-depth: 0
          ref: ${{ inputs.ref }}
          repository: ${{ inputs.repo }}


      - uses: extractions/setup-just@f8a3cce218d9f83db3a2ecd90e41ac3de6cdfd9b # v3

      - name: Run Build
        env:
          GH_TOKEN: ${{ github.token }}
          GH_PR_EVENT_NUMBER: ${{ inputs.pr_event_number }}
          COSIGN_PRIVATE_KEY: ${{ secrets.TEST_SIGNING_SECRET }}
        run: just test-generate-iso-web-ui

  iso-from-recipe:
    timeout-minutes: 60
    runs-on: ubuntu-latest
    permissions:
      contents: read # read repo contents
      packages: write # write test package to ghcr
      id-token: write # docker auth

    steps:
      - name: Maximize build space
        uses: ublue-os/remove-unwanted-software@cc0becac701cf642c8f0a6613bbdaf5dc36b259e # v9

      - uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
        with:
          install: true

      - uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c # v1.15.2

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          fetch-depth: 0
          ref: ${{ inputs.ref }}
          repository: ${{ inputs.repo }}


      - uses: extractions/setup-just@f8a3cce218d9f83db3a2ecd90e41ac3de6cdfd9b # v3

      - name: Run Build
        env:
          GH_TOKEN: ${{ github.token }}
          GH_PR_EVENT_NUMBER: ${{ inputs.pr_event_number }}
          COSIGN_PRIVATE_KEY: ${{ secrets.TEST_SIGNING_SECRET }}
        run: just test-generate-iso-image

  container-podman-build:
    timeout-minutes: 60
    runs-on: ubuntu-latest
    permissions:
      contents: read # read repo contents
      packages: write # write test package to ghcr
      id-token: write # docker auth

    steps:
      - name: Maximize build space
        uses: ublue-os/remove-unwanted-software@cc0becac701cf642c8f0a6613bbdaf5dc36b259e # v9

      - uses: earthly/actions-setup@43211c7a0eae5344d6d79fb4aaf209c8f8866203 # v1.0.13
        with:
          use-cache: false

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
        with:
          install: true

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          fetch-depth: 0
          ref: ${{ inputs.ref }}
          repository: ${{ inputs.repo }}

      - uses: extractions/setup-just@f8a3cce218d9f83db3a2ecd90e41ac3de6cdfd9b # v3

      - name: Run Build
        env:
          GH_TOKEN: ${{ github.token }}
          GH_PR_EVENT_NUMBER: ${{ inputs.pr_event_number }}
          COSIGN_PRIVATE_KEY: ${{ secrets.TEST_SIGNING_SECRET }}
        run: just test-container-podman-build

  container-podman-build-chunked-oci:
    timeout-minutes: 60
    runs-on: ubuntu-latest
    permissions:
      contents: read # read repo contents
      packages: write # write test package to ghcr
      id-token: write # docker auth

    steps:
      - name: Maximize build space
        uses: ublue-os/remove-unwanted-software@cc0becac701cf642c8f0a6613bbdaf5dc36b259e # v9

      - uses: earthly/actions-setup@43211c7a0eae5344d6d79fb4aaf209c8f8866203 # v1.0.13
        with:
          use-cache: false

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
        with:
          install: true

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          fetch-depth: 0
          ref: ${{ inputs.ref }}
          repository: ${{ inputs.repo }}

      - uses: extractions/setup-just@f8a3cce218d9f83db3a2ecd90e41ac3de6cdfd9b # v3

      - name: Run Build
        env:
          GH_TOKEN: ${{ github.token }}
          GH_PR_EVENT_NUMBER: ${{ inputs.pr_event_number }}
          COSIGN_PRIVATE_KEY: ${{ secrets.TEST_SIGNING_SECRET }}
        run: just test-container-podman-build-chunked-oci

  container-podman-rechunk:
    timeout-minutes: 60
    runs-on: ubuntu-latest
    permissions:
      contents: read # read repo contents
      packages: write # write test package to ghcr
      id-token: write # docker auth

    steps:
      - name: Maximize build space
        uses: ublue-os/remove-unwanted-software@cc0becac701cf642c8f0a6613bbdaf5dc36b259e # v9

      - uses: earthly/actions-setup@43211c7a0eae5344d6d79fb4aaf209c8f8866203 # v1.0.13
        with:
          use-cache: false

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
        with:
          install: true

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          fetch-depth: 0
          ref: ${{ inputs.ref }}
          repository: ${{ inputs.repo }}

      - uses: extractions/setup-just@f8a3cce218d9f83db3a2ecd90e41ac3de6cdfd9b # v3

      - name: Run Build
        env:
          GH_TOKEN: ${{ github.token }}
          GH_PR_EVENT_NUMBER: ${{ inputs.pr_event_number }}
          COSIGN_PRIVATE_KEY: ${{ secrets.TEST_SIGNING_SECRET }}
        run: just test-container-podman-rechunk