build-image.yml

name: Build image
on:
  workflow_call:
    inputs:
      containerfile:
        description: "The path to the Containerfile"
        required: true
        type: string
      image-name:
        description: "The name of the image to build"
        required: true
        type: string
      previous-image:
        description: "The previous version of this image. This will be used to compute the changelog."
        required: false
        type: string
      image-description:
        description: "The description of the image to build"
        required: false
        type: string
        default: "AlmaLinux image"
      REGISTRY:
        description: "The registry to push the image to"
        required: false
        type: string
        default: "ghcr.io"
      image-path:
        description: "The path to the image in the registry"
        required: false
        type: string
        # default: "${{ github.event.repository.owner.login }}"
        default: "${{ github.repository_owner }}"
      platforms:
        description: "The platforms to build the image for"
        required: false
        type: string
        default: "amd64,arm64"
      docs-url:
        description: "The URL to the documentation for the image"
        required: false
        type: string
        default: "${{ github.event.repository.html_url }}"
      REGISTRY_USER:
        description: "The username to use for the registry"
        required: false
        type: string
        default: "${{ github.actor }}"
      upstream-public-key:
        description: "The public key of the upstream image"
        required: false
        type: string
      skip-maximize-build-space:
        description: "Skip maximizing the build space"
        required: false
        type: boolean
        default: false
      generate-sbom:
        description: "Generate a Software Bill of Materials (SBOM) for the image"
        required: false
        type: boolean
        default: false
      changelog-snippet:
        description: "Middle snippet of the changelog, to highlight major components"
        required: false
        type: string
        default: |
          Major Components:
            - Kernel: <relver:kernel>
            - Systemd: <relver:systemd>
            - Glibc: <relver:glibc>
            - Bootc: <relver:bootc>
      variant:
        description: "The variant of the image to build"
        required: false
        type: string
      KMS_KEY_ALIAS:
        description: "The AWS KMS alias to use for signing the image"
        required: false
        type: string
      AWS_REGION:
        description: "The AWS region to use for signing the image"
        required: false
        type: string
    outputs:
      image-ref:
        description: "The image reference of the built image"
        value: ${{ jobs.manifest.outputs.image }}
      digest:
        description: "The digest of the built image"
        value: ${{ jobs.manifest.outputs.digest }}
      version:
        description: "The version of the built image"
        value: ${{ jobs.manifest.outputs.version }}
      redhat-version-id:
        description: "The redhat.version-id label of the built image"
        value: ${{ jobs.manifest.outputs.redhat-version-id }}
      major-version:
        description: "The major version of the built image"
        value: ${{ jobs.manifest.outputs.major-version }}
    secrets:
      REGISTRY_TOKEN:
        description: "The token to use for the registry"
        required: true
      SIGNING_SECRET:
        description: "The private key used to sign the image"
        required: false
      AWS_ROLE_ARN:
        description: "The AWS role ARN to assume for S3 uploads"
        required: false

env:
  IMAGE_NAME: ${{ inputs.image-name }}
  CONTAINERFILE: ${{ inputs.containerfile }}
  IMAGE_REGISTRY: ${{ inputs.REGISTRY }}
  IMAGE_PATH: ${{ inputs.image-path }}
  SIGNING_ENABLED: ${{ (secrets.SIGNING_SECRET != null && secrets.SIGNING_SECRET != '') || inputs.KMS_KEY_ALIAS != '' }}
  INTERNAL_ACTIONS_REF: v11

concurrency:
  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}-${{ inputs.image-name }}
  cancel-in-progress: true

jobs:
  generate_matrix:
    name: Prepare build
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
      tag: ${{ steps.set-matrix.outputs.tag }}
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4

      - name: Checkout github actions
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
        with:
          repository: AlmaLinux/atomic-ci
          ref: ${{ env.INTERNAL_ACTIONS_REF }}
          path: github-actions

      - uses: ./github-actions/.github/actions/prepare-build
        name: Prepare build
        id: set-matrix
        with:
          platforms: ${{ inputs.platforms }}
          containerfile: ${{ inputs.containerfile }}
          upstream-public-key: ${{ inputs.upstream-public-key }}

  build_push:
    name: Build and push image
    runs-on: ${{ matrix.platform == 'arm64' && 'ubuntu-24.04-arm' || 'ubuntu-24.04' }}
    timeout-minutes: 60
    needs: generate_matrix
    strategy:
      fail-fast: false
      matrix: ${{fromJson(needs.generate_matrix.outputs.matrix)}}
    permissions:
      contents: read
      packages: write
      id-token: write

    outputs:
      image-ref: ${{ steps.push.outputs.image-ref }}
      digest: ${{ steps.push.outputs.digest }}
      redhat-id: ${{ steps.check.outputs.redhat-id }}
      redhat-version-id: ${{ steps.check.outputs.redhat-version-id }}
      version: ${{ steps.load.outputs.version }}

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
        with:
          fetch-depth: 0 # Fetch all history for changelog generation

      - name: Checkout github actions
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
        with:
          repository: AlmaLinux/atomic-ci
          ref: ${{ env.INTERNAL_ACTIONS_REF }}
          path: github-actions

      - uses: ./github-actions/.github/actions/build
        name: Build image
        id: build
        with:
          platform: ${{ matrix.platform }}
          variant: ${{ inputs.variant }}
          containerfile: ${{ inputs.containerfile }}
          image-name: ${{ inputs.image-name }}
          image-path: ${{ inputs.image-path }}
          image-tag: ${{ needs.generate_matrix.outputs.tag }}
          skip-maximize-build-space: ${{ inputs.skip-maximize-build-space }}
          docs-url: ${{ inputs.docs-url }}
          changelog-snippet: ${{ inputs.changelog-snippet }}
          image-description: ${{ inputs.image-description }}
          previous-image: ${{ inputs.previous-image }}
          REGISTRY: ${{ inputs.REGISTRY }}
          REGISTRY_USER: ${{ inputs.REGISTRY_USER }}
          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}

      - uses: ./github-actions/.github/actions/sbom
        name: Generate SBOM
        id: generate-sbom
        if: ${{ inputs.generate-sbom == true && (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) || github.event.pull_request.merged == true) }}
        with:
          image-ref: ${{ steps.build.outputs.image-ref }}@${{ steps.build.outputs.digest }}
          artifact-name: ${{ inputs.image-name }}-${{ inputs.variant }}-${{ matrix.platform }}

      - uses: ./github-actions/.github/actions/sign
        name: Sign image
        id: sign
        if: ${{ env.SIGNING_ENABLED == 'true' && (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) || github.event.pull_request.merged == true) }}
        with:
          image-ref: ${{ steps.build.outputs.image-ref }}@${{ steps.build.outputs.digest }}
          signing-secret: ${{ secrets.SIGNING_SECRET }}
          sbom-path: ${{ steps.generate-sbom.outputs.sbom-path }}
          KMS_KEY_ALIAS: ${{ inputs.KMS_KEY_ALIAS }}
          AWS_REGION: ${{ inputs.AWS_REGION }}
          AWS_ROLE_ARN: ${{ secrets.AWS_ROLE_ARN }}


  manifest:
    name: Create Manifest
    runs-on: ubuntu-latest
    needs:
      - generate_matrix
      - build_push
    permissions:
      contents: read
      packages: write
      id-token: write
    outputs:
      image: ${{ steps.push_manifest.outputs.image-ref }}
      digest: ${{ steps.push_manifest.outputs.digest }}
      version: ${{ steps.push_manifest.outputs.version }}
      redhat-version-id: ${{ steps.push_manifest.outputs.redhat-version-id }}
      major-version: ${{ steps.push_manifest.outputs.major-version }}
      signing-enabled: ${{ env.SIGNING_ENABLED }}
    steps:
      - name: Checkout github actions
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
        with:
          repository: AlmaLinux/atomic-ci
          ref: ${{ env.INTERNAL_ACTIONS_REF }}
          path: github-actions

      - uses: ./github-actions/.github/actions/manifest
        id: push_manifest
        name: Create Manifest
        with:
          platforms: ${{ inputs.platforms }}
          image-name: ${{ inputs.image-name }}
          image-path: ${{ inputs.image-path }}
          image-tag: ${{ needs.generate_matrix.outputs.tag }}
          image-description: ${{ inputs.image-description }}
          docs-url: ${{ inputs.docs-url }}
          containerfile: ${{ inputs.containerfile }}
          REGISTRY: ${{ inputs.REGISTRY }}
          REGISTRY_USER: ${{ inputs.REGISTRY_USER }}
          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}

      - uses: ./github-actions/.github/actions/sign
        name: Sign Manifest
        id: sign
        if: ${{ env.SIGNING_ENABLED == 'true' && (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) || github.event.pull_request.merged == true) }}
        with:
          image-ref: ${{ steps.push_manifest.outputs.image-ref }}@${{ steps.push_manifest.outputs.digest }}
          signing-secret: ${{ secrets.SIGNING_SECRET }}
          KMS_KEY_ALIAS: ${{ inputs.KMS_KEY_ALIAS }}
          AWS_REGION: ${{ inputs.AWS_REGION }}
          AWS_ROLE_ARN: ${{ secrets.AWS_ROLE_ARN }}