image.yml

name: image

# Canonical release: on a version tag, build the collector clean-room (the eBPF crate +
# userspace binary), push the runtime image to GHCR, scan it for CVEs, and keyless-sign it.
# The internal A3S registry (what the egress-constrained cluster pulls) is fed by mirroring.
on:
  push:
    tags: ['v*']
  workflow_dispatch: {}

permissions:
  contents: read
  packages: write
  id-token: write # keyless cosign signing via GitHub OIDC

jobs:
  image:
    runs-on: ubuntu-latest # 24.04 — glibc matches the ubuntu:24.04 runtime base
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@nightly
        with:
          components: rust-src # build-std for the bpfel-unknown-none eBPF target
      - run: cargo install bpf-linker --locked
      - run: cargo build --release -p a3s-observer-collector
      - name: stage binary (small build context)
        run: mkdir -p dist && cp target/release/a3s-observer-collector dist/
      - uses: docker/setup-buildx-action@v3
      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - id: img
        run: echo "name=ghcr.io/${GITHUB_REPOSITORY,,}" >> "$GITHUB_OUTPUT" # ghcr needs lowercase
      - id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ steps.img.outputs.name }}
          tags: |
            type=semver,pattern={{version}}
            type=ref,event=tag
      - id: build
        uses: docker/build-push-action@v6
        with:
          context: dist
          file: deploy/Dockerfile
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          provenance: true # SLSA build provenance attestation
          sbom: true # SBOM attestation
      # Supply chain: scan for fixable CRITICAL CVEs, then keyless-sign the pushed digest.
      - name: Trivy image scan (report fixable CRITICAL/HIGH)
        uses: aquasecurity/trivy-action@master # TODO: pin to a release SHA once chosen
        with:
          image-ref: ${{ steps.img.outputs.name }}@${{ steps.build.outputs.digest }}
          severity: CRITICAL,HIGH
          ignore-unfixed: true
          exit-code: '0' # report-only; set to '1' to block releases once the base is confirmed clean
      - uses: sigstore/cosign-installer@v3
      - name: Sign the image (keyless, GitHub OIDC)
        run: cosign sign --yes ${{ steps.img.outputs.name }}@${{ steps.build.outputs.digest }}