build-docker.yaml

name: Build Docker

on:
  pull_request:
    types: [labeled, synchronize]
    branches:
      - main
      - release/*
  push:
    tags:
      - 'v*'

concurrency:
  group: docker-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

env:
  REGISTRY: docker.cloudsmith.io
  REGISTRY_NAMESPACE: circle/arc-network

jobs:
  build:
    if: >-
      github.event_name == 'push' ||
      contains(github.event.pull_request.labels.*.name, 'build-docker')
    name: Build ${{ matrix.image }} (${{ matrix.platform }})
    permissions:
      contents: read
      id-token: write
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        image:
          - arc-execution
          - arc-consensus
        platform:
          - linux/amd64
          - linux/arm64
        include:
          - platform: linux/amd64
            arch: amd64
            runner: ubuntu-latest
          - platform: linux/arm64
            arch: arm64
            runner: ubuntu-24.04-arm
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          submodules: recursive

      - name: Compute short hash
        id: vars
        env:
          SHA: ${{ github.sha }}
        run: echo "short_hash=${SHA::8}" >> "$GITHUB_OUTPUT"

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0

      - name: Build image
        id: build
        uses: docker/bake-action@6614cfa25eff9a0b2b2697efb0b6159e7680d584 # v7.2.0
        with:
          source: .
          files: docker-bake.hcl
          targets: ${{ matrix.image }}
          set: |
            ${{ matrix.image }}.platform=${{ matrix.platform }}
            ${{ matrix.image }}.tags=
            ${{ matrix.image }}.output=type=oci,tar=false,dest=/tmp/image
        env:
          BUILDX_NO_DEFAULT_ATTESTATIONS: 1
          GITHUB_TOKEN: ${{ github.token }}
          GIT_COMMIT_HASH: ${{ github.sha }}
          GIT_VERSION: ${{ github.ref_name }}
          GIT_SHORT_HASH: ${{ steps.vars.outputs.short_hash }}

      - name: Trivy vulnerability scan
        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
        with:
          input: /tmp/image
          format: sarif
          output: trivy-results.sarif
          severity: CRITICAL
          limit-severities-for-sarif: true
          exit-code: '1'

      - name: Upload Trivy scan results
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: trivy-${{ matrix.image }}-${{ matrix.arch }}
          path: trivy-results.sarif

      - name: Login to Cloudsmith
        if: ${{ github.event_name == 'push' }}
        uses: ./.github/actions/cloudsmith-login
        with:
          registry: ${{ env.REGISTRY }}

      - name: Push image by digest
        if: ${{ github.event_name == 'push' }}
        env:
          IMAGE: ${{ env.REGISTRY }}/${{ env.REGISTRY_NAMESPACE }}/${{ matrix.image }}
          BAKE_METADATA: ${{ steps.build.outputs.metadata }}
          MATRIX_IMAGE: ${{ matrix.image }}
          MATRIX_PLATFORM: ${{ matrix.platform }}
        run: |
          DIGEST=$(echo "${BAKE_METADATA}" | jq -r --arg img "${MATRIX_IMAGE}" '.[$img]."containerimage.digest"')
          if [ -z "${DIGEST}" ] || [ "${DIGEST}" = "null" ]; then
            echo "::error::Failed to extract digest from build metadata"
            exit 1
          fi
          skopeo copy "oci:/tmp/image" "docker://${IMAGE}@${DIGEST}" --digestfile /tmp/push-digest
          rm -rf /tmp/image
          REGISTRY_DIGEST=$(cat /tmp/push-digest)
          if [ "${DIGEST}" != "${REGISTRY_DIGEST}" ]; then
            echo "::warning::Bake metadata digest ${DIGEST} differs from registry digest ${REGISTRY_DIGEST}"
          fi
          PLATFORM_SLUG=$(echo "${MATRIX_PLATFORM}" | tr '/' '-')
          mkdir -p "/tmp/digests/${MATRIX_IMAGE}"
          echo "${REGISTRY_DIGEST}" > "/tmp/digests/${MATRIX_IMAGE}/${PLATFORM_SLUG}"

      - name: Upload digest
        if: ${{ github.event_name == 'push' }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: digest-${{ matrix.image }}-${{ matrix.arch }}
          path: /tmp/digests/${{ matrix.image }}/*
          if-no-files-found: error

  manifest:
    if: ${{ github.event_name == 'push' }}
    name: Manifest ${{ matrix.image }}
    permissions:
      contents: read
      id-token: write
      attestations: write
    needs: [build]
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        image:
          - arc-execution
          - arc-consensus
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          sparse-checkout: .github/actions

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0

      - name: Login to Cloudsmith
        uses: ./.github/actions/cloudsmith-login
        with:
          registry: ${{ env.REGISTRY }}

      - name: Download digests
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: digest-${{ matrix.image }}-*
          merge-multiple: true
          path: /tmp/digests

      - name: Create and inspect multi-arch manifest
        id: manifest
        env:
          IMAGE: ${{ env.REGISTRY }}/${{ env.REGISTRY_NAMESPACE }}/${{ matrix.image }}
          RELEASE_TAG: ${{ github.ref_name }}
        run: |
          VERSION="${RELEASE_TAG#v}"
          TAG="${IMAGE}:${VERSION}"

          # Build digest args from all platform artifacts
          DIGEST_ARGS=()
          for f in /tmp/digests/*; do
            DIGEST_ARGS+=("${IMAGE}@$(cat "$f")")
          done

          if [ ${#DIGEST_ARGS[@]} -eq 0 ]; then
            echo "::error::No digest files found"
            exit 1
          fi

          # Create and push the manifest list
          docker buildx imagetools create -t "${TAG}" "${DIGEST_ARGS[@]}"

          MANIFEST_DIGEST=$(docker buildx imagetools inspect "${TAG}" --raw | sha256sum | awk '{print "sha256:"$1}')
          echo "digest=${MANIFEST_DIGEST}" >> "$GITHUB_OUTPUT"
          echo "image-with-digest=${IMAGE}@${MANIFEST_DIGEST}" >> "$GITHUB_OUTPUT"

      - name: Generate SBOM
        continue-on-error: true
        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
        with:
          image: ${{ steps.manifest.outputs.image-with-digest }}
          artifact-name: sbom-${{ matrix.image }}.spdx.json
          output-file: sbom-${{ matrix.image }}.spdx.json
          upload-release-assets: false

      - name: Attest build provenance
        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
        with:
          subject-name: ${{ env.REGISTRY }}/${{ env.REGISTRY_NAMESPACE }}/${{ matrix.image }}
          subject-digest: ${{ steps.manifest.outputs.digest }}
          push-to-registry: true

      - name: Attest SBOM
        uses: actions/attest-sbom@07e74fc4e78d1aad915e867f9a094073a9f71527 # v4.0.0
        with:
          subject-name: ${{ env.REGISTRY }}/${{ env.REGISTRY_NAMESPACE }}/${{ matrix.image }}
          subject-digest: ${{ steps.manifest.outputs.digest }}
          sbom-path: sbom-${{ matrix.image }}.spdx.json
          push-to-registry: true