images-dev.yaml

name: Dev Image CI Build

# Any change in triggers needs to be reflected in the concurrency group.
on:
  pull_request_target:
    types:
      - opened
      - synchronize
      - reopened
  push:
    branches:
      - main

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.event.after }}
  cancel-in-progress: true

jobs:
  build:
    if: ${{ github.repository == 'cilium/cilium-cli' }}
    runs-on: ubuntu-24.04
    outputs:
      tag: ${{ steps.tag.outputs.tag }}
      repo_tags: ${{ steps.tag.outputs.repo_tags }}
      digest: ${{ steps.docker_build.outputs.digest }}

    steps:
      - name: Getting image tag
        id: tag
        run: |
          if [ "${{ github.event.pull_request.head.sha }}" != "" ]; then
            echo "tag=${{ github.event.pull_request.head.sha }}" >> $GITHUB_OUTPUT
            echo "repo_tags=quay.io/${{ github.repository_owner }}/cilium-cli-ci:${{ github.event.pull_request.head.sha }}" >> $GITHUB_OUTPUT
          else
            echo "tag=${{ github.sha }}" >> $GITHUB_OUTPUT
            echo "repo_tags=quay.io/${{ github.repository_owner }}/cilium-cli-ci:latest,quay.io/${{ github.repository_owner }}/cilium-cli-ci:${{ github.sha }}" >> $GITHUB_OUTPUT
          fi

      # SECURITY: Checking out untrusted code from pull_request_target
      # This workflow uses pull_request_target which has write access to the base repository.
      # The code being checked out may come from a forked repository and should be treated as untrusted.
      # Build steps run in this job should not have access to any secrets or credentials.
      - name: Checkout Untrusted Source Code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          ref: ${{ steps.tag.outputs.tag }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0

      - name: Docker Build
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        id: docker_build
        with:
          context: .
          platforms: linux/arm64,linux/amd64
          push: false
          tags: quay.io/${{ github.repository_owner }}/cilium-cli-ci:${{ steps.tag.outputs.tag }}
          outputs: type=oci,dest=/tmp/image.tar

      - name: Upload image artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: docker-image
          path: /tmp/image.tar
          retention-days: 1

  push:
    needs: build
    if: ${{ github.repository == 'cilium/cilium-cli' }}
    runs-on: ubuntu-24.04
    environment: ci

    steps:
      - name: Download image artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: docker-image
          path: /tmp

      - name: Install skopeo
        run: |
          sudo apt-get update
          sudo apt-get install -y skopeo

      - name: Push image to registry
        env:
          QUAY_USERNAME: ${{ secrets.QUAY_CI_USERNAME }}
          QUAY_PASSWORD: ${{ secrets.QUAY_CI_TOKEN }}
        run: |
          for tag in $(echo "${{ needs.build.outputs.repo_tags }}" | tr ',' '\n'); do
            skopeo copy \
              --multi-arch all \
              --dest-creds "${QUAY_USERNAME}:${QUAY_PASSWORD}" \
              oci-archive:/tmp/image.tar \
              "docker://${tag}"
          done