Add update-image job after build_and_push job

.github/workflows/on-pull-request.yaml

@@ -10,3 +10,7 @@ jobs:
     with:
       push-ghcr: false
       save-cache: false
+      update-image: true
+    secrets:
+      github-app-id: ${{ secrets.PUSHER_APP_ID }}
+      github-app-private-key: ${{ secrets.PUSHER_PRIVATE_KEY }}

.github/workflows/on-push-main.yaml

@@ -11,3 +11,4 @@ jobs:
     with:
       push-ghcr: true
       save-cache: true
+      update-image: true

.github/workflows/wf-docker-build.yaml

@@ -9,6 +9,14 @@ on:
       save-cache:
         type: boolean
         default: false
+      update-image:
+        type: boolean
+        default: false
+    secrets:
+      github-app-id:
+        required: false
+      github-app-private-key:
+        required: false
 
 jobs:
   build_and_push:
@@ -17,6 +25,8 @@ jobs:
     permissions:
       contents: read
       packages: write
+    outputs:
+      tags: ${{ steps.meta.outputs.tags }}
     steps:
       - uses: actions/checkout@v4
       - uses: docker/setup-buildx-action@v3
@@ -52,3 +62,21 @@ jobs:
           set: |
             *.cache-from=type=gha
             ${{ inputs.save-cache && '*.cache-to=type=gha,mode=max' || '' }}
+
+  update_image:
+    name: Update Image
+    runs-on: ubuntu-latest
+    needs: build_and_push
+    if: inputs.update-image
+    steps:
+      - uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.github-app-id }}
+          private-key: ${{ secrets.github-app-private-key }}
+      - name: Update Manifests
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAGS: ${{ needs.build_and_push.outputs.tags }}
+        run: |
+          TAG=$(echo "$TAGS" | grep "sha-")
+          gh workflow run --repo ictsc/ictsc-regalia-release update-image.yaml -f "tag=$TAG"