build-latest.yml

name: 🍜 Build/publish urunc-deploy image

on:
  workflow_call:
    inputs:
      runner:
        type: string
        default: '["base", "dind", "2204"]'
      runner-archs:
        type: string
        default: '["amd64", "aarch64"]'
      dockerfiles:
        type: string
        default: '["Dockerfile"]'
      runner-arch-map:
        type: string
        default: '[{"amd64":"x86_64", "aarch64":"aarch64", "armv7l":"armv7l"}]'
      registry:
        type: string
        default: 'ghcr.io'
      version-tag:
        type: boolean
        default: false

permissions:
  contents: read

jobs:
  build-all:
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 600
    permissions:
      contents: write # for uploading the SBOM to the release
      packages: write # for uploading the finished container
      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
      id-token: write # to complete the identity challenge with sigstore/fulcio when running outside of PRs
    strategy:
      matrix:
        include:
          - arch: amd64
            runner: ubuntu-22.04
          - arch: arm64
            runner: ubuntu-22.04-arm
    continue-on-error: true

    env:
      REGISTRY: ${{ inputs.registry }}
      IMAGE_NAME: ${{ inputs.registry }}/${{ github.repository }}/urunc-deploy
      ARCH: ${{ matrix.arch }}

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
        with:
          egress-policy: audit

      - name: Checkout the repo
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set short SHA
        run: echo "SHA_SHORT=${GITHUB_SHA::7}" >> $GITHUB_ENV

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0

      - name: Log into registry ${{ env.REGISTRY }}
        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf
        with:
          images: ${{ env.IMAGE_NAME }}
          tags: |
            type=sha,prefix=${{ env.ARCH }}-

      - name: Get revision SHA and branch (safe)
        id: get-rev
        env:
          EVENT_NAME: ${{ github.event_name }}
          IS_MERGED: ${{ github.event.pull_request.merged }}
          GITHUB_SHA: ${{ github.sha }}
          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
          PR_HEAD_REF: ${{ github.event.pull_request.head.ref }}
          PR_BASE_REF: ${{ github.event.pull_request.base.ref }}
          REF_NAME: ${{ github.ref_name }}
        run: |
          if [ "$EVENT_NAME" == "pull_request" ]; then
            if [ "$IS_MERGED" == "true" ]; then
              sha="$GITHUB_SHA"
              branch="$PR_BASE_REF"
              echo "PR merged. SHA: ${sha}, Branch: ${branch}"
            else
              sha="$PR_HEAD_SHA"
              branch="$PR_HEAD_REF"
              echo "PR not yet merged. SHA: ${sha}, Branch: ${branch}"
            fi
          else
            sha="$GITHUB_SHA"
            branch="$REF_NAME"
            echo "$EVENT_NAME event. SHA: ${sha}, Branch: ${branch}"
          fi

          echo "sha=${sha}" >> "$GITHUB_OUTPUT"
          echo "branch=${branch}" >> "$GITHUB_OUTPUT"
 
      - name: Build and push urunc-deploy-${{ matrix.arch}}
        id: build-and-push
        uses: docker/build-push-action@789f68658055d3ca993799b232b5c46dfe3f114d # master
        with:
          context: ./deployment/urunc-deploy
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          push: true
          file: ${{ inputs.dockerfiles }}
          build-args: |
            BRANCH=${{ steps.get-rev.outputs.branch }}
            REPO=${{ github.repository }}
          provenance: false
 
      - name: Get image digest
        run: |
          echo "IMAGE_DIGEST=$(docker inspect \
          ${{ env.REGISTRY }}/${{ github.repository }}/urunc-deploy:${{ env.ARCH }}-${{ env.SHA_SHORT }} | \
          jq -r '.[0].Id')" >> $GITHUB_ENV

      - name: Install cosign
        uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # main

      - name: Sign the published Docker image
        env:
          COSIGN_EXPERIMENTAL: "true"
          DIGEST: ${{steps.build-and-push.outputs.digest}}
        run: |
          cosign sign --yes ${{ env.REGISTRY }}/${{ github.repository }}/urunc-deploy@$DIGEST \
          -a "repo=${{github.repository}}" \
          -a "workflow=${{github.workflow}}" \
          -a "ref=${{github.sha}}" \
          -a "author=Nubificus LTD"

  manifest:
    needs: [build-all]
    runs-on: ubuntu-22.04
    permissions:
      contents: write # for uploading the SBOM to the release
      packages: write # for uploading the finished container
      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
      id-token: write # to complete the identity challenge with sigstore/fulcio when running outside of PRs
    env:
      REGISTRY: ${{ inputs.registry }}

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
        with:
          egress-policy: audit

      - name: Checkout the repo
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set SHA and Docker tag based on branch or PR
        id: tag
        run: |
          # Set SHA_SHORT to be used for the manifest
          SHORT_SHA=$(echo "${GITHUB_SHA}" | cut -c1-7)
          echo "SHA_SHORT=${SHORT_SHA}" >> $GITHUB_ENV

          # Determine the manifests' TAG
          if [[ ${{ inputs.version-tag }} == true ]]; then
            echo "Version change detected. Using version: $( cat VERSION )."
            echo "TAG=$( cat VERSION ) " >> $GITHUB_ENV
          elif [[ "${GITHUB_REF##*/}" == "main" ]]; then
            echo "Change in main branch detected. Using latest tag."
            echo "TAG=latest" >> $GITHUB_ENV
          else
            SHORT_SHA=$(echo "${GITHUB_SHA}" | cut -c1-7)
            echo "Using tag: ${SHORT_SHA}."
            echo "TAG=${SHORT_SHA}" >> $GITHUB_ENV
          fi


      - name: Log into registry ${{ inputs.REGISTRY }}
        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Process runner architectures and create docker manifest
        id: create-manifest
        run: |
          #FIXME: find a way to match runner_archs with the strategy matrix input
          runner_archs='${{ inputs.runner-archs }}'  # Using the input string array
          amend_command=""

          # Loop over the architectures and build the amend command
          for arch in $(echo $runner_archs | jq -r '.[]'); do
            amend_command+=" --amend ${{ env.REGISTRY }}/${{ github.repository }}/urunc-deploy:$arch-${{ env.SHA_SHORT }}"
          done

          echo "-------------------- Amend command constructed -------------------"
          echo "$amend_command"

          # Create the docker manifest with the amend command
          docker manifest create ${{ env.REGISTRY }}/${{ github.repository }}/urunc-deploy:${{ env.TAG }} $amend_command

          VAR=`docker manifest push ${{ env.REGISTRY }}/${{ github.repository }}/urunc-deploy:${{ env.TAG }} | tail -1`
          echo "manifest_sha=$VAR" >> "$GITHUB_OUTPUT"

          # Also tag with commit hash on main branch
          if [[ "${{ github.ref }}" == "refs/heads/main" && "${{ inputs.version-tag }}" != "true" ]]; then
            docker buildx imagetools create -t ${{ env.REGISTRY }}/${{ github.repository }}/urunc-deploy:${{ env.SHA_SHORT }} \
              ${{ env.REGISTRY }}/${{ github.repository }}/urunc-deploy:${{ env.TAG }}
          fi


      - name: Install cosign
        uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # main

      - name: Sign the published Docker image
        env:
          COSIGN_EXPERIMENTAL: "true"
          DIGEST: ${{steps.create-manifest.outputs.manifest_sha }}
        run: |
          cosign sign --yes ${{ env.REGISTRY }}/${{ github.repository }}/urunc-deploy@$DIGEST \
          -a "repo=${{github.repository}}" \
          -a "workflow=${{github.workflow}}" \
          -a "ref=${{github.sha}}" \
          -a "author=Nubificus LTD"