nightly.yaml

name: nightly

permissions: {}

on:
  schedule:
    - cron: "30 1 * * *"

defaults:
  run:
    shell: bash

jobs:
  build:
    uses: ./.github/workflows/.reusable-build.yml
    permissions:
      id-token: write
      packages: write
    secrets: inherit
    with:
      skip: "non-required"

  compliance:
    uses: ./.github/workflows/.reusable-compliance.yml
    permissions:
      actions: read
      attestations: read
      checks: read
      contents: write
      deployments: read
      discussions: read
      id-token: write
      issues: read
      packages: read
      pages: read
      pull-requests: write
      repository-projects: read
      security-events: write
      statuses: read
    secrets: inherit
    with:
      skip: "none"

  sca-released:
    name: sca (released)
    uses: ./.github/workflows/.reusable-sca.yml
    needs: [build]
    permissions:
      contents: write
      security-events: write
      packages: read
    secrets: inherit
    with:
      image: ${{ needs.build.outputs.original_image }}
      skip: "none"
      output: "table"

  integration-test:
    uses: ./.github/workflows/.reusable-integration-test.yml
    needs: [build]
    permissions:
      packages: read
    secrets: inherit
    with:
      build_registry: ${{ needs.build.outputs.original_registry }}
      repo_owner: ${{ github.repository_owner }}
      build_image_repository: ${{ needs.build.outputs.original_registry }}/${{ needs.build.outputs.original_repo }}
      build_tag: ${{ needs.build.outputs.original_tag }}
      skip: "non-required"

  cleanup-registry:
    uses: ./.github/workflows/.reusable-cleanup-registry.yml
    needs: [build]
    secrets: inherit