- name: Maximize build space
        uses: jlumbroso/free-disk-space@v1.3.1
        with:
          android: true
          dotnet: true
          haskell: true
          large-packages: true
          docker-images: false
          swap-storage: true

- name: Build image (rootful)
        id: build_image
        run: |
          # Builds image in root store as root, to be picked up by Rechunker
          sudo buildah bud \
            --format docker \
            --tag "localhost/${IMAGE_NAME}:${{ env.DEFAULT_TAG }}" \
            --file Containerfile \
            .

- name: Run Rechunker
        id: rechunk
        uses: hhd-dev/rechunk@v1.2.3
        with:
          rechunk: "ghcr.io/hhd-dev/rechunk:v1.2.3"
          ref: "localhost/${{ env.IMAGE_NAME }}:${{ env.DEFAULT_TAG }}"
          prev-ref: "${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.DEFAULT_TAG }}"
          skip_compression: false
          max-layers: 110
          labels: ${{ steps.metadata.outputs.labels }}

- name: Load in podman and tag
       run: |
         IMAGE=$(podman pull ${STEPS_RECHUNK_OUTPUTS_REF})
         sudo rm -rf ${STEPS_RECHUNK_OUTPUTS_LOCATION}
         for tag in ${STEPS_METADATA_OUTPUTS_TAGS}; do
           podman tag $IMAGE ${IMAGE_NAME}:$tag
         done
       env:
         STEPS_RECHUNK_OUTPUTS_REF: ${{ steps.rechunk.outputs.ref }}
         STEPS_RECHUNK_OUTPUTS_LOCATION: ${{ steps.rechunk.outputs.location }}
         STEPS_METADATA_OUTPUTS_TAGS: ${{ steps.metadata.outputs.tags }}
         IMAGE_NAME: ${{ env.IMAGE_NAME }}

- name: Lowercase Registry 
        id: registry_case
        uses: ASzc/change-string-case-action@v6
        with:
          string: ${{ env.IMAGE_REGISTRY }}

- name: Sign container image
        id: sign_container_image
        if: github.event_name != 'pull_request'
        run: |
          echo "${STEPS_PUSH_OUTPUTS_REGISTRY_PATHS}"
          IMAGE_FULL="${STEPS_REGISTRY_CASE_OUTPUTS_LOWERCASE}/${IMAGE_NAME}"
          cosign sign -y --key env://COSIGN_PRIVATE_KEY $IMAGE_FULL@"${STEPS_PUSH_OUTPUTS_DIGEST}"
        env:
          COSIGN_EXPERIMENTAL: false
          COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
          STEPS_PUSH_OUTPUTS_REGISTRY_PATHS: ${{ steps.push.outputs.registry-paths }}
          STEPS_REGISTRY_CASE_OUTPUTS_LOWERCASE: ${{ steps.registry_case.outputs.lowercase }}
          STEPS_PUSH_OUTPUTS_DIGEST: ${{ steps.push.outputs.digest }}