build.yml

# =============
# This file is automatically generated from the templates in stackabletech/operator-templating
# DON'T MANUALLY EDIT THIS FILE
# =============
---
name: Build Operator Artifacts

permissions: {}

on:
  push:
    branches:
      - main
    tags:
      - '[0-9][0-9].[0-9]+.[0-9]+-rc[0-9]+'
      - '[0-9][0-9].[0-9]+.[0-9]+'
  schedule:
    # Run every Saturday morning: https://crontab.guru/#15_3_*_*_6
    - cron: '15 3 * * 6'
  workflow_dispatch:
  pull_request:
  merge_group:

env:
  RUST_NIGHTLY_TOOLCHAIN_VERSION: "nightly-2025-05-26"
  NIX_PKG_MANAGER_VERSION: "2.30.0"
  RUST_TOOLCHAIN_VERSION: "1.87.0"
  HADOLINT_VERSION: "v2.12.0"
  PYTHON_VERSION: "3.13"
  CARGO_TERM_COLOR: always

jobs:
  changed-files:
    name: List Changed Files
    runs-on: ubuntu-latest
    permissions:
      pull-requests: read
    outputs:
      relevant: ${{ steps.filter.outputs.relevant }}
    steps:
      - name: Checkout Repository
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          persist-credentials: false
          submodules: recursive

      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
        id: filter
        with:
          filters: |
            relevant:
              - '.github/workflows/build.yml'
              - 'rust-toolchain.toml'
              - '.dockerignore'
              - 'deploy/**'
              - 'docker/**'
              - 'Cargo.*'
              - 'nix/**'
              - '**.rs'

  # This job is always run, because we want to catch all potential lints/errors/warnings
  pre-commit:
    name: Run pre-commit
    runs-on: ubuntu-latest
    steps:
      - name: Install host dependencies
        uses: awalsh128/cache-apt-pkgs-action@2c09a5e66da6c8016428a2172bd76e5e4f14bb17 # v1.5.3
        with:
          packages: protobuf-compiler krb5-user libkrb5-dev libclang-dev liblzma-dev libssl-dev pkg-config apt-transport-https
          version: ubuntu-latest

      - name: Checkout Repository
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          persist-credentials: false
          submodules: recursive
          fetch-depth: 0

      - name: Run pre-commit
        uses: stackabletech/actions/run-pre-commit@bdac99602eb834b85fdddf207d68e51d0e8b9380 # v0.9.3
        with:
          rust: ${{ env.RUST_NIGHTLY_TOOLCHAIN_VERSION }}
          nix-github-token: ${{ secrets.GITHUB_TOKEN }}
          python-version: ${{ env.PYTHON_VERSION }}
          nix: ${{ env.NIX_PKG_MANAGER_VERSION }}
          hadolint: ${{ env.HADOLINT_VERSION }}

  # This job is always run to ensure we don't miss any new upstream advisories
  cargo-deny:
    name: Run cargo-deny
    runs-on: ubuntu-latest
    # Prevent sudden announcement of a new advisory from failing CI
    continue-on-error: ${{ matrix.checks == 'advisories' }}
    strategy:
      matrix:
        checks:
          - advisories
          - bans licenses sources
    steps:
      - name: Checkout Repository
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          persist-credentials: false
          submodules: recursive

      - name: Run cargo-deny
        uses: EmbarkStudios/cargo-deny-action@f2ba7abc2abebaf185c833c3961145a3c275caad # v2.0.13
        with:
          command: check ${{ matrix.checks }}

  # NOTE (@Techassi): This could instead be done by pre-commit (requires cargo-udeps to be installed)
  cargo-udeps:
    name: Run cargo-udeps
    runs-on: ubuntu-latest
    env:
      RUSTC_BOOTSTRAP: 1
    steps:
      - name: Install host dependencies
        uses: awalsh128/cache-apt-pkgs-action@2c09a5e66da6c8016428a2172bd76e5e4f14bb17 # v1.5.3
        with:
          packages: protobuf-compiler krb5-user libkrb5-dev libclang-dev liblzma-dev libssl-dev pkg-config apt-transport-https
          version: ubuntu-latest

      - name: Checkout Repository
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          persist-credentials: false
          submodules: recursive

      - name: Install Rust ${{ env.RUST_TOOLCHAIN_VERSION }} toolchain
        uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN_VERSION }}

      - name: Setup Rust Cache
        uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
        with:
          cache-all-crates: "true"
          key: udeps

      - name: Install cargo-udeps
        uses: stackabletech/cargo-install-action@8f7dbbcd2ebe22717efc132d0dd61e80841994b9 # cargo-udeps

      - name: Run cargo-udeps
        run: cargo udeps --workspace --all-targets

  build-image:
    if: ${{ needs.changed-files.outputs.relevant == 'true' }}
    name: Build/Publish ${{ matrix.runner.arch }} Image
    needs:
      - changed-files
      - cargo-udeps
      - pre-commit
      - cargo-deny
    permissions:
      id-token: write
    strategy:
      fail-fast: false
      matrix:
        runner:
          - {name: "ubuntu-latest", arch: "amd64"}
          - {name: "ubicloud-standard-8-arm", arch: "arm64"}
    runs-on: ${{ matrix.runner.name }}
    outputs:
      operator-version: ${{ steps.version.outputs.OPERATOR_VERSION }}
      operator-name: ${{ steps.name.outputs.OPERATOR_NAME }}
    steps:
      - name: Install host dependencies
        uses: awalsh128/cache-apt-pkgs-action@2c09a5e66da6c8016428a2172bd76e5e4f14bb17 # v1.5.3
        with:
          packages: protobuf-compiler krb5-user libkrb5-dev libclang-dev liblzma-dev libssl-dev pkg-config apt-transport-https
          version: ${{ matrix.runner.name }}

      - name: Checkout Repository
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          persist-credentials: false
          submodules: recursive

      - name: Extract Operator Name
        id: name
        env:
          GITHUB_REPOSITORY: ${{ github.repository }}
          GITHUB_DEBUG: ${{ runner.debug }}
        shell: bash
        run: |
          set -euo pipefail
          [ -n "$GITHUB_DEBUG" ] && set -x

          OPERATOR_NAME=$(echo "$GITHUB_REPOSITORY" | cut -d '/' -f 2)
          echo "OPERATOR_NAME=$OPERATOR_NAME" | tee -a "$GITHUB_OUTPUT"

      - name: Update/Extract Operator Version
        id: version
        env:
          PR_BASE_REF: ${{ github.event.pull_request.base.ref }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
          GITHUB_EVENT_NAME: ${{ github.event_name }}
          GITHUB_DEBUG: ${{ runner.debug }}
        shell: bash
        run: |
          set -euo pipefail
          [ -n "$GITHUB_DEBUG" ] && set -x

          CURRENT_VERSION=$(cargo metadata --format-version 1 --no-deps | jq -r '.packages[0].version')

          if [ "$GITHUB_EVENT_NAME" == "pull_request" ]; then
            if [ "$PR_BASE_REF" == 'main' ]; then
              NEW_VERSION="0.0.0-pr$PR_NUMBER"
            else
              NEW_VERSION="$CURRENT_VERSION-pr$PR_NUMBER"
            fi

            sed -i "s/version = \"${CURRENT_VERSION}\"/version = \"${NEW_VERSION}\"/" Cargo.toml
            echo "OPERATOR_VERSION=$NEW_VERSION" | tee -a "$GITHUB_OUTPUT"
          else
            echo "OPERATOR_VERSION=$CURRENT_VERSION" | tee -a "$GITHUB_OUTPUT"
          fi

      - name: Install Nix
        uses: cachix/install-nix-action@fc6e360bedc9ee72d75e701397f0bb30dce77568 # v31.5.2

      - name: Install Rust ${{ env.RUST_TOOLCHAIN_VERSION }} Toolchain
        uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN_VERSION }}

      - name: Build Container Image
        id: build
        uses: stackabletech/actions/build-container-image@7ffd8c8c5c0378ebeae80f95e2680510d3d1be4c # TODO: Use released image
        with:
          image-name: ${{ steps.name.outputs.OPERATOR_NAME }}
          image-index-manifest-tag: ${{ steps.version.outputs.OPERATOR_VERSION }}
          build-arguments: VERSION=${{ steps.version.outputs.OPERATOR_VERSION }}
          container-file: docker/Dockerfile

      - name: Publish Container Image
        uses: stackabletech/actions/publish-image@7ffd8c8c5c0378ebeae80f95e2680510d3d1be4c # TODO: Use released image
        with:
          image-registry-uri: oci.stackable.tech
          image-registry-username: robot$sdp+github-action-build
          image-registry-password: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
          image-repository: sdp/${{ steps.name.outputs.OPERATOR_NAME }}
          image-manifest-tag: ${{ steps.build.outputs.image-manifest-tag }}
          source-image-uri: ${{ steps.build.outputs.image-manifest-uri }}

  publish-index:
    name: Publish/Sign ${{ needs.build-image.outputs.operator-version }} Index
    needs:
      - build-image
    permissions:
      id-token: write
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Repository
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          persist-credentials: false
          submodules: recursive

      - name: Publish and Sign Image Index
        uses: stackabletech/actions/publish-index-manifest@497f3e3cbfe9b89b1e570351b97d050eebcad5d0 # 0.8.3
        with:
          image-registry-uri: oci.stackable.tech
          image-registry-username: robot$sdp+github-action-build
          image-registry-password: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
          image-repository: sdp/${{ needs.build-image.outputs.operator-name }}
          image-index-manifest-tag: ${{ needs.build-image.outputs.operator-version }}

  package-chart:
    name: Package/Publish ${{ needs.build-image.outputs.operator-version }} Helm Chart
    needs:
      - publish-index
      - build-image
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Repository
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          persist-credentials: false
          submodules: recursive

      - name: Package, Publish, and Sign Helm Chart
        uses: stackabletech/actions/publish-helm-chart@0030b0c102b79d50bc25e4eb86810754504487c2 # TODO: Use released version
        with:
          chart-registry-uri: oci.stackable.tech
          chart-registry-username: robot$sdp-charts+github-action-build
          chart-registry-password: ${{ secrets.HARBOR_ROBOT_SDP_CHARTS_GITHUB_ACTION_BUILD_SECRET }}
          chart-repository: sdp-charts
          chart-directory: deploy/helm/${{ needs.build-image.outputs.operator-name }}
          chart-version: ${{ needs.build-image.outputs.operator-version }}
          app-version: ${{ needs.build-image.outputs.operator-version }}

  openshift-preflight-check:
    name: Run OpenShift Preflight Check for ${{ needs.build-image.outputs.operator-version }}-${{ matrix.arch }}
    needs:
      - package-chart
      - build-image
    strategy:
      fail-fast: false
      matrix:
        arch:
          - amd64
          - arm64
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Repository
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          persist-credentials: false
          submodules: recursive

      - name: Run OpenShift Preflight Check
        uses: stackabletech/actions/run-openshift-preflight@50f31550a09fc10b16892a85edfb75b6f2e448d6 # TODO: Use released version
        with:
          image-index-uri: oci.stackable.tech/sdp/${{ needs.build-image.outputs.operator-name }}:${{ needs.build-image.outputs.operator-version }}
          image-architecture: ${{ matrix.arch }}