when:
  - event: pull_request

steps:
  # PR gate: build the CA-baked plugin image only, no push. buildah runs
  # unprivileged in-cluster, so use the vfs storage driver + chroot isolation.
  - name: build
    image: quay.io/buildah/stable
    commands:
      - "buildah build --isolation chroot --storage-driver vfs -t plugin-docker-buildx:${CI_COMMIT_SHA} ."
    backend_options:
      kubernetes:
        serviceAccountName: plugin-docker-buildx
        resources:
          requests:
            memory: 512Mi
            cpu: 1
          limits:
            memory: 2Gi
            cpu: 2