reinstate-images.yaml

on:
  workflow_dispatch:
    inputs:
      dry_run:
        type: boolean
        default: 'true'
        description: If true, just log

permissions:
  contents: read

jobs:
  reinstate:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
        with:
          egress-policy: audit
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
      - uses: chainguard-dev/setup-chainctl@8d93dcbef466d3cf3533f67084f52eb74ef9d262 # v0.2.4
        with:
          identity: 720909c9f5279097d847ad02a2f24ba8f59de36a/b6461e99e132298f
      - uses: imjasonh/setup-crane@31b88efe9de28ae0ffa220711af4b60be9435f6e # v0.4
      - name: Reinstate images
        env:
          DRY_RUN: ${{ github.event.inputs.dry_run }}
        run: |
          set -x
          for img in $(grep -v '\#' reinstated-images.txt); do
            tag_ref="$(echo $img | cut -d@ -f1)"
            tag="$(echo $tag_ref | cut -d: -f2)"
            digest_ref="$(echo $img | sed 's/:[^@]*@/@/')"
            # Note: if "crane digest" passes, do not attempt to retag it
            if [[ "$DRY_RUN" == "false" ]]; then
              crane digest "$tag_ref" || crane tag "$digest_ref" "$tag" || true
            else
              echo "DRY RUN: crane digest "$tag_ref" || crane tag "$digest_ref" "$tag" || true"
            fi
          done