name: Mirror Image

on:
  workflow_call:
    inputs:
      version:
        required: true
        type: string
    secrets:
      PROD_AWS_ROLE:
        required: true
  workflow_dispatch:
    inputs:
      version:
        description: 'Image tag'
        required: true
        type: string

jobs:
  mirror:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      id-token: write
    steps:
      - name: configure aws credentials
        uses: aws-actions/configure-aws-credentials@5fd3084fc36e372ff1fff382a39b10d03659f355 # v2.2.0
        with:
          role-to-assume: ${{ secrets.PROD_AWS_ROLE }}
          aws-region: us-east-1
      - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
        with:
          registry: public.ecr.aws
      - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: akhilerm/tag-push-action@eadeefebd39db8a47e146115649adae1fce576a6 # v2.3.0
        with:
          src: docker.io/supabase/studio:${{ inputs.version }}
          dst: |
            public.ecr.aws/supabase/studio:${{ inputs.version }}
            ghcr.io/supabase/studio:${{ inputs.version }}