name: ImageCanary
on:
  workflow_dispatch:
  schedule:
  - cron: '0 */1 * * *'
jobs:
  image-canary:
    runs-on: ubuntu-latest
    permissions:
      id-token: write # aws-actions/configure-aws-credentials@v4.0.1
    if: github.repository == 'aws/karpenter-provider-aws'
    steps:
    - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
    - name: Configure AWS credentials
      uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
      with:
        role-to-assume: arn:aws:iam::${{ vars.READONLY_ACCOUNT_ID }}:role/${{ vars.READONLY_ROLE_NAME }}
        aws-region: ${{ vars.READONLY_REGION }}
        role-duration-seconds: 900
    # Authenticate to public ECR to prevent rate limiting
    - uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
      with:
        registry: public.ecr.aws
        logout: true
      env:
        AWS_REGION: us-east-1
    - name: Run image canary
      env:
        GH_TOKEN: ${{ github.token }}
      run: ./hack/image_canary.sh
    - name: Notify slack of failure
      if: failure() && github.event_name != 'workflow_run'
      uses: ./.github/actions/e2e/slack/send-message
      with:
        message: ":alert: image canary failure (https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}) @channel"
        url: ${{ secrets.SLACK_WEBHOOK_URL }}