zuul: Add job to automatically publish images on dockerhub

This inherits from the "ara-container-images" job that already builds
and test container images, this additional job just publishes the
resulting images.

Change-Id: I456eb2ae942bcb8dbd4206c2858b2e408995ae30

.zuul.d/jobs.yaml

@@ -159,3 +159,15 @@
     description: |
       Builds ARA API container images with buildah and briefly tests them with podman.
     run: tests/with_container_images.yaml
+
+- job:
+    name: ara-container-images-dockerhub
+    parent: ara-container-images
+    description: |
+      Builds ARA API container images with buildah and briefly tests them with podman.
+      The resulting images are pushed to dockerhub if successful.
+    run: tests/zuul_publish_dockerhub.yaml
+    secrets:
+      - name: ara_dockerhub_credentials
+        secret: ara_dockerhub_credentials
+        pass-to-parent: true

.zuul.d/project.yaml

@@ -31,3 +31,4 @@
       jobs:
         - ara-upload-git-mirror
         - ara-demo
+        - ara-container-images-dockerhub

.zuul.d/secrets.yaml

@@ -62,3 +62,19 @@
           OYDOK8xhxqwcJPSHVD1nBm5172tlut+TEuYUaUMnkQA0ajK37oAhY81JIHZcit6IVeAj7
           KhRM5o2h0k4URdX3Cxi8Rb4nH4VL5uCU4fLrjgCdbuuD/fgVjVHvp9tkbvSBGWOa1Mj4J
           kx8QNfyoOAev+hd8cfGYrkXDnhaR5vqOJXGnk2z9dgIna/MrHKpEup4vPM/opE=
+
+- secret:
+    name: ara_dockerhub_credentials
+    data:
+      username: arainfra
+      password: !encrypted/pkcs1-oaep
+        - AZXXb4drChUuwokT2YnvHzNdGqSlhWueevQzD5kQRt+cQrxldqzPwfpUXyKEfA2uyrQhw
+          2inTbe0Xuve/fBgDt0H1goGqllUsAXpwVDYM4l9tpptBOth4ifq4+JGwJ6vRY8QV7BuTa
+          RS0xDQeG361/MygRCgv7caiPKbr7MMQYWNzh3ZRIogy5LV9Ums1DMB53V13b6fnB3J1iD
+          5OXi8KaZT9S9OXTgylcxKvijvs3IrS61HksG/VXksxvQJAohr0l7oyxBNn4Xg44iRZwn3
+          Yxh+NPoAUyk04TLC5NCwimF6+aC6YONbr8Ha9duefyTLvfo8AS1mC720bi2fMlk23u8mN
+          ntGL4uGBDCsiIy4mXgyrn3MfxA1orjwiXh9yzwUn8+pu7vmXIMvj4vd3kQfdSF8Dt0xwc
+          1p/4SeBmeRhqT+eYgOTZNJkSO+VCr3e360cYFRVTx1JXAizY4hAZvdY3969/HUy+1s3Mj
+          7sEoMRIbBgd9zpAFy6Q0GdCKMLRZXhnOvfJx5W5qqbU4yDfmvsg4WQ+o8ed3vByTAhBzD
+          V3mZ0qOM9e9S00S1dsTGR9Jfl0qVO5fZ8NrAKUmtdn8hDd/efXxjArTtHkVQs7HbF2Wp9
+          DD3Jn475bxwaB/RwY1NlSSQXgzmgAI2tt43H40kQkE9z/BG3U+owjhp3uIJu50=

tests/zuul_publish_dockerhub.yaml

@@ -0,0 +1,46 @@
+#  Copyright (c) 2020 Red Hat, Inc.
+#
+#  This file is part of ARA Records Ansible.
+#
+#  ARA is free software: you can redistribute it and/or modify
+#  it under the terms of the GNU General Public License as published by
+#  the Free Software Foundation, either version 3 of the License, or
+#  (at your option) any later version.
+#
+#  ARA is distributed in the hope that it will be useful,
+#  but WITHOUT ANY WARRANTY; without even the implied warranty of
+#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#  GNU General Public License for more details.
+#
+#  You should have received a copy of the GNU General Public License
+#  along with ARA.  If not, see <http://www.gnu.org/licenses/>.
+
+- name: Publish container images to DockerHub
+  hosts: all
+  gather_facts: yes
+  vars:
+    destination: docker.io/recordsansible/ara-api
+    images:
+      # These images are meant to be provided by the "with_container_images.yaml" playbook
+      - name: localhost/ara-api
+        tag: distribution-latest
+      - name: localhost/ara-api
+        tag: pypi-latest
+      - name: localhost/ara-api
+        tag: source-latest
+  tasks:
+    - name: Tag images with buildah
+      command: buildah tag {{ item.name }}:{{ item:tag }} {{ destination }}:{{ item:tag }}
+      loop: "{{ images }}"
+
+    - name: Tag latest from source-latest
+      command: buildah tag {{ destination }}:source-latest {{ destination }}:latest
+
+    - name: Push latest
+      command: buildah push --creds {{ ara_dockerhub_credentials.username }}:{{ ara_dockerhub_credentials.password }} {{ destination }}:latest
+      no_log: yes
+
+    - name: Push the remainder of the tags
+      command: buildah push --creds {{ ara_dockerhub_credentials.username }}:{{ ara_dockerhub_credentials.password }} {{ destination }}:{{ item.tag }}
+      no_log: yes
+      loop: "{{ images }}"