add publish workflow

.github/workflows/publish.yml

@@ -0,0 +1,108 @@
+name: Publish
+
+on:
+  push:
+    branches:
+      - main
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+  push:
+    name: push container
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      packages: write
+
+    outputs:
+      image: ${{ steps.push.outputs.image }}
+
+    steps:
+      - uses: actions/checkout@v4
+      - uses: DeterminateSystems/nix-installer-action@v9
+      - uses: DeterminateSystems/magic-nix-cache-action@v3
+      - uses: nixbuild/nixbuild-action@v19
+        with:
+          nixbuild_token: ${{ secrets.NIXBUILD_TOKEN }}
+          generate_summary_for: 'workflow'
+
+      - name: Log into the container registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: build and load container
+        run: |
+          STORE_PATH="$(
+            nix build \
+              --json \
+              --print-build-logs \
+              --builders "" \
+              --max-jobs 2 \
+              --eval-store auto \
+              --store ssh-ng://eu.nixbuild.net \
+              --system x86_64-linux \
+              .#container | \
+              jq -r '.[0].outputs.out'
+          )"
+
+          nix copy \
+            --from ssh-ng://eu.nixbuild.net \
+            --substitute \
+            "$STORE_PATH"
+
+          "$STORE_PATH" | docker load
+
+      - name: push container
+        id: push
+        run: |
+          REPO="$(docker images --format json | grep mazes | jq -r ".Repository" | head -n 1)"
+          TAG="$(docker images --format json | grep mazes | jq -r ".Tag" | head -n 1)"
+
+          SOURCE_NAME="$REPO:$TAG"
+          FINAL_NAME="$REGISTRY/$IMAGE_NAME:$TAG"
+          echo "$SOURCE_NAME -> $FINAL_NAME"
+
+          docker tag "$SOURCE_NAME" "$FINAL_NAME"
+          docker push "$FINAL_NAME"
+
+          echo "image=$FINAL_NAME" >> "$GITHUB_OUTPUT"
+
+  publish:
+    name: publish manifest
+    runs-on: ubuntu-latest
+    environment: production
+    needs: push
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          repository: bytes-zone/infrastructure.v2
+          ref: main
+          ssh-key: ${{ secrets.DEPLOY_KEY }}
+      - uses: DeterminateSystems/nix-installer-action@v9
+      - uses: DeterminateSystems/magic-nix-cache-action@v3
+
+      - name: update manifest
+        run: |
+          nix-shell \
+            -p kustomize \
+            --run 'cd manifests/apps/mazes && kustomize edit set image ${{ needs.push.outputs.image }}'
+
+      - name: commit and push changes
+        run: |
+          DIFF="$(git diff | tee /dev/stderr)"
+          if test -n "$DIFF"; then
+            git config --global user.name "Github Actions"
+            git config --global user.email "noreply@github.com"
+
+            git add manifests/apps/mazes
+            git commit --message "update mazes to ${{ needs.push.outputs.image }}"
+            git push
+          fi