name: e2e

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

on:
  workflow_dispatch:
  schedule:
    - cron: '0 10 * * *'
  push:
    branches:
      - 'master'
    tags:
      - 'v*'

jobs:
  build:
    uses: ./.github/workflows/.e2e-run.yml
    permissions:
      contents: read
      id-token: write # to get Docker Hub and AWS credentials
      packages: write # to push image to GHCR
    strategy:
      fail-fast: false
      matrix:
        include:
          -
            name: Distribution
            id: distribution
            provider: none
            type: local
          -
            name: Docker Hub
            registry: ''
            slug: dockereng/build-push-action-test
            provider: dockerhub
            type: remote
          -
            name: GitHub
            registry: ghcr.io
            slug: ghcr.io/docker/build-push-action-test
            provider: ghcr
            type: remote
          -
            name: GitLab
            registry: registry.gitlab.com
            slug: registry.gitlab.com/test1716/test
            provider: gitlab
            type: remote
          -
            name: AWS ECR
            registry: 175142243308.dkr.ecr.us-east-2.amazonaws.com
            slug: 175142243308.dkr.ecr.us-east-2.amazonaws.com/sandbox/test-docker-action
            provider: aws
            type: remote
          -
            name: AWS ECR Public
            registry: public.ecr.aws
            slug: public.ecr.aws/q3b5f1u4/test-docker-action
            provider: aws
            type: remote
          -
            name: Google Artifact Registry
            registry: us-east4-docker.pkg.dev
            slug: us-east4-docker.pkg.dev/sandbox-298914/docker-official-github-actions/test-docker-action
            provider: gar
            type: remote
          -
            name: Azure Container Registry
            registry: officialgithubactions.azurecr.io
            slug: officialgithubactions.azurecr.io/test-docker-action
            provider: acr
            type: remote
          -
            name: Quay
            registry: quay.io
            slug: quay.io/docker_build_team/ghactiontest
            provider: quay
            type: remote
          -
            name: Artifactory
            registry: infradock.jfrog.io
            slug: infradock.jfrog.io/test-ghaction/build-push-action
            provider: artifactory
            type: remote
          -
            name: Harbor
            id: harbor
            provider: none
            type: local
          -
            name: Nexus
            id: nexus
            provider: none
            type: local
    with:
      id: ${{ matrix.id }}
      type: ${{ matrix.type }}
      provider: ${{ matrix.provider }}
      name: ${{ matrix.name }}
      registry: ${{ matrix.registry }}
      slug: ${{ matrix.slug }}
    secrets:
      # Pass only the registry-specific secrets needed by each matrix entry.
      # GHCR uses the called workflow's GITHUB_TOKEN fallback.
      # Docker Hub and AWS ECR use OIDC to get credentials.
      registry_username: >-
        ${{
          matrix.provider == 'dockerhub' && 'dockereng' ||
          matrix.provider == 'gitlab' && secrets.GITLAB_USERNAME ||
          matrix.provider == 'gar' && secrets.GAR_USERNAME ||
          matrix.provider == 'acr' && secrets.AZURE_CLIENT_ID ||
          matrix.provider == 'quay' && secrets.QUAY_USERNAME ||
          matrix.provider == 'artifactory' && secrets.ARTIFACTORY_USERNAME ||
          ''
        }}
      registry_password: >-
        ${{
          matrix.provider == 'gitlab' && secrets.GITLAB_TOKEN ||
          matrix.provider == 'gar' && secrets.GAR_JSON_KEY ||
          matrix.provider == 'acr' && secrets.AZURE_CLIENT_SECRET ||
          matrix.provider == 'quay' && secrets.QUAY_TOKEN ||
          matrix.provider == 'artifactory' && secrets.ARTIFACTORY_TOKEN ||
          ''
        }}
