name: Latest Images
on:
  push:
    branches:
      - 'stable-f[0-9][0-9]'
    paths-ignore:
      - "**.md"
      - ".github/workflows/moderator.yml"
      - ".github/workflows/scorecard.yml"
  merge_group:
    branches:
      - 'stable-f[0-9][0-9]'
  pull_request:
    branches:
      - 'stable-f[0-9][0-9]'
    paths-ignore:
      - "**.md"
      - ".github/workflows/moderator.yml"
      - ".github/workflows/scorecard.yml"
  workflow_call:
  workflow_dispatch:

permissions: {}

jobs:
  build-image-latest:
    name: Build Latest Images
    uses: $/.github/workflows/reusable-build.yml
    permissions:
      contents: read
      packages: write
      id-token: write
      attestations: write
      artifact-metadata: write
    secrets:
      SIGNING_SECRET: ${{ secrets.SIGNING_SECRET }}
    with:
      image_flavors: '["main", "nvidia-open"]'
      stream_name: latest
      # FIXME: MAIN has no arm builds in ublue-os/akmods yet
      # https://github.com/ublue-os/akmods/pull/440
      # architecture: '["aarch64","x86_64"]'
      architecture: '["x86_64"]'
      publish: ${{ github.event_name != 'pull_request' }}

  generate-release:
    name: Generate Release
    needs: [build-image-latest]
    permissions:
      contents: write
    uses: $/.github/workflows/generate-release.yml
    with:
      stream_name: '["latest"]'