bake_targets.yml

name: Build, test and publish a target extension

on:
  workflow_call:
    inputs:
      extension_name:
        description: "The PostgreSQL extension to build (directory name)"
        required: true
        type: string
    secrets:
      SNYK_TOKEN:
        required: false

permissions: {}

jobs:
  testbuild:
    name: Build ${{ inputs.extension_name }}
    runs-on: ${{ github.repository_owner == 'cloudnative-pg' && 'ubuntu-latest-16-cores' || 'ubuntu-24.04' }}
    permissions:
      contents: read
      packages: write
      # Required by the cosign step
      id-token: write
    outputs:
      metadata: ${{ steps.build.outputs.metadata }}
      images: ${{ steps.images.outputs.images }}
    steps:
      - name: Checkout Code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Log in to the GitHub Container registry
        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up QEMU
        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4
        with:
          platforms: 'linux/arm64'

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4

      - name: Build and push
        uses: docker/bake-action@6614cfa25eff9a0b2b2697efb0b6159e7680d584 # v7
        id: build
        env:
          BUILDX_METADATA_PROVENANCE: disabled
          environment: testing
          registry: ghcr.io/${{ github.repository_owner }}
          revision: ${{ github.sha }}
        with:
          files: ./${{ inputs.extension_name }}/metadata.hcl,./docker-bake.hcl
          push: true

      # From bake's metadata, extract each unique tag (e.g. the ones with the timestamp)
      - name: Generated images
        env:
          BUILD_METADATA: ${{ steps.build.outputs.metadata }}
        id: images
        run: |
          echo "images=$(jq -c '[ .[]."image.name" | split(",")[] | select(test("[0-9]{12}")) ]' <<< "$BUILD_METADATA")" >>  "$GITHUB_OUTPUT"

      # Even if we're testing we sign the images, so we can push them to production later if that's required
      - name: Install cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
        # See https://github.blog/security/supply-chain-security/safeguard-container-signing-capability-actions/
        # and https://github.com/actions/starter-workflows/blob/main/ci/docker-publish.yml for more details on
        # how to use cosign.
      - name: Sign images
        env:
          BUILD_METADATA: ${{ steps.build.outputs.metadata }}
        run: |
          jq -r '.[] | (."image.name" | sub(",.*";"")) + "@" + ."containerimage.digest"' <<< "$BUILD_METADATA" | \
            xargs cosign sign --yes

  security:
    name: Security checks
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      packages: read
      security-events: write
    needs:
      - testbuild
    strategy:
      fail-fast: false
      matrix:
        image: ${{fromJson(needs.testbuild.outputs.images)}}
    steps:
      - name: Checkout Code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Security checks
        uses: cloudnative-pg/postgres-containers/.github/actions/security-scans@main
        with:
          image: "${{ matrix.image }}"
          registry_user: ${{ github.actor }}
          registry_token: ${{ secrets.GITHUB_TOKEN }}
          snyk_token: ${{ secrets.SNYK_TOKEN }}
          dockerfile: "${{ inputs.extension_name }}/Dockerfile"

  smoke-test:
    name: Smoke test
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      packages: read
    needs:
      - testbuild
    strategy:
      fail-fast: false
      matrix:
        image: ${{fromJson(needs.testbuild.outputs.images)}}
        cnpg: ["main", "1.28", "1.29"]
    steps:
      - name: Checkout Code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Install Task
        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0

      - name: Install Dagger
        env:
          # renovate: datasource=github-tags depName=dagger/dagger versioning=semver
          DAGGER_VERSION: 0.20.8
        run: |
          curl -L https://dl.dagger.io/dagger/install.sh | BIN_DIR=$HOME/.local/bin sh

      - name: Set up environment
        env:
          CNPG_RELEASE: ${{ matrix.cnpg }}
        run: |
          task e2e:setup-env CNPG_RELEASE=$CNPG_RELEASE

      - name: Generate Chainsaw testing values
        env:
          MATRIX_IMAGE: ${{ matrix.image }}
          EXTENSION_NAME: ${{ inputs.extension_name }}
        run: |
          task e2e:generate-values EXTENSION_IMAGE="${MATRIX_IMAGE}" TARGET="${EXTENSION_NAME}"

      - name: Run e2e tests
        env:
          EXTENSION_NAME: ${{ inputs.extension_name }}
        run: |
          # Get Kind cluster internal kubeconfig
          task e2e:export-kubeconfig KUBECONFIG_PATH=./kubeconfig INTERNAL=true

          task e2e:test TARGET="${EXTENSION_NAME}" KUBECONFIG_PATH="./kubeconfig"

  copytoproduction:
    name: Copy images to production
    if: ${{ github.ref == 'refs/heads/main' }}
    runs-on: ubuntu-24.04
    needs:
      - testbuild
      - security
      - smoke-test
    permissions:
      contents: read
      packages: write
      # Required by the cosign step
      id-token: write
    steps:
      - name: Copy to production
        uses: cloudnative-pg/postgres-containers/.github/actions/copy-images@main
        with:
          bake_build_metadata: "${{ needs.testbuild.outputs.metadata }}"
          registry_user: ${{ github.actor }}
          registry_token: ${{ secrets.GITHUB_TOKEN }}