podman/.github/workflows/swagger.yml

name: Publish swagger

# Build the libpod API spec (pkg/api/swagger.yaml) and publish it to the
# public GCS bucket consumed by the API reference docs
# (docs/source/_static/api.html -> https://storage.googleapis.com/libpod-master-releases/swagger-<version>.yaml).
# Pushes to main publish "swagger-latest.yaml"; tags publish "swagger-<tag>.yaml".
on:
  push:
    branches:
      - main
    tags:
      - "v*"

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  publish-swagger:
    # TODO we need to setup the permissions and likely use our new oracle bucket instead
    # For now lets just skip this part
    if: false
    name: Build and publish swagger.yaml
    runs-on: cncf-ubuntu-8-32-x86
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Install build dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            gawk \
            libassuan-dev \
            libbtrfs-dev \
            libgpgme-dev \
            libseccomp-dev \
            libsystemd-dev \
            libclone-perl \
            man-db \
            podman \
            python3-pip

      - name: Set up Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: go.mod
          cache: false

      - name: Build swagger.yaml
        run: make swagger

      - name: Publish swagger.yaml to GCS
        env:
          GCPJSON: ${{ secrets.GCPJSON }}
          GCPNAME: ${{ secrets.GCPNAME }}
          GCPPROJECT: libpod-218412
          # Pushes to main publish "latest"; tags publish under their tag name.
          TO_GCSURI: gs://libpod-master-releases/swagger-${{ github.ref_type == 'tag' && github.ref_name || 'latest' }}.yaml
          FROM_FILEPATH: /src/pkg/api/swagger.yaml
          # Uploader image tag, copied from .cirrus.yml IMAGE_SUFFIX.
          GCSUPLD_FQIN: quay.io/libpod/gcsupld:c20260425t010036z-f43f42d14
        run: |
          # Pass secrets through podman's environment (-e VAR) rather than an
          # env-file so they are never written to disk.
          podman run --rm --security-opt label=disable \
            -e GCPJSON -e GCPNAME -e GCPPROJECT -e FROM_FILEPATH -e TO_GCSURI \
            -v "$GITHUB_WORKSPACE:/src:ro" \
            --workdir /src \
            "$GCSUPLD_FQIN"