reusable_build_image.yaml

---
on:
  workflow_call:
    inputs:
      product-name:
        description: The boil product directory name (e.g. "hadoop" or "precompiled/hadoop")
        required: true
        type: string
      image-name:
        description: |
          The image name used in the OCI registry. Defaults to product-name if not set.
          This is used when the boil directory is nested (eg: precompiled/hadoop) but
          the parent directory will be used as the namespace (eg: precompiled).
        default: ""
        type: string
      sdp-version:
        required: true
        type: string
      registry-namespace:
        required: true
        type: string
      runners:
        description: |
          The type of runners used.
          - `mixed`: x86_64 builds run on the GitHub hosted runners and the aarch64 builds run on the Ubicloud runners
          - `ubicloud`: Both the x86_64 and the aarch64 builds run on the Ubicloud runners
        default: mixed
        type: string
      publish:
        description: Whether to publish and sign images.
        type: boolean
        default: true
      publish-to-quay:
        description: |
          Whether to publish to quay.io or not. If `true`, the `quay-robot-secret` needs to be
          provided.
        type: boolean
        default: true
    secrets:
      harbor-robot-secret:
        description: The secret for the Harbor robot user used to push images and manifest
        required: true
      quay-robot-secret:
        description: The secret for the Quay.io robot user used to push images and manifest
      slack-token:
        description: The Slack token used to post failure notifications
        required: true

permissions: {}

jobs:
  generate_runner_dimension:
    name: Generate Runner Dimension
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false

      - id: runners
        shell: bash
        env:
          RUNNERS_TYPE: ${{ inputs.runners }}
        run: |
          if [ "$RUNNERS_TYPE" == "mixed" ]; then
            RUNNERS=$(jq --compact-output < .github/workflows/runners/mixed.json)
            echo "RUNNERS=$RUNNERS" | tee -a "$GITHUB_OUTPUT"
          elif [ "$RUNNERS_TYPE" == "ubicloud" ]; then
            RUNNERS=$(jq --compact-output < .github/workflows/runners/ubicloud.json)
            echo "RUNNERS=$RUNNERS" | tee -a "$GITHUB_OUTPUT"
          else
            echo "Invalid runners type, expected 'mixed' or 'ubicloud'"
            exit 1
          fi
    outputs:
      runners: ${{ steps.runners.outputs.RUNNERS }}

  generate_version_dimension:
    name: Generate Version Dimension
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false

      - id: shard
        uses: stackabletech/actions/shard@d0a8db3ba80e974b872c09cb5311f04e0e78582e # v0.16.1
        with:
          product-name: ${{ inputs.product-name }}
          boil-version: 0.2.2
    outputs:
      versions: ${{ steps.shard.outputs.versions }}

  build:
    name: Build/Publish ${{ matrix.versions }}-${{ matrix.runner.arch }} Image
    needs:
      - generate_version_dimension
      - generate_runner_dimension
    permissions:
      id-token: write
      contents: read
    runs-on: ${{ matrix.runner.name }}
    strategy:
      fail-fast: false
      matrix:
        versions: ${{ fromJson(needs.generate_version_dimension.outputs.versions) }}
        runner: ${{ fromJson(needs.generate_runner_dimension.outputs.runners) }}
    steps:
      - name: Checkout Repository
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false

      - name: Free Disk Space
        uses: stackabletech/actions/free-disk-space@d0a8db3ba80e974b872c09cb5311f04e0e78582e # v0.16.1

      - name: Build Product Image
        id: build
        uses: stackabletech/actions/build-product-image@d0a8db3ba80e974b872c09cb5311f04e0e78582e # v0.16.1
        with:
          registry-namespace: ${{ inputs.registry-namespace }}
          product-name: ${{ inputs.product-name }}
          product-version: ${{ matrix.versions }}
          sdp-version: ${{ inputs.sdp-version }}
          boil-version: 0.2.2

      - name: Publish Container Image on oci.stackable.tech
        if: inputs.publish
        uses: stackabletech/actions/publish-image@d0a8db3ba80e974b872c09cb5311f04e0e78582e # v0.16.1
        with:
          image-registry-uri: oci.stackable.tech
          image-registry-username: robot$${{ inputs.registry-namespace }}+github-action-build
          image-registry-password: ${{ secrets.harbor-robot-secret }}
          # NOTE (@NickLarsenNZ): This fallback is just for now so we can support both repo level
          # image folders that go under the sdp namespace AND nested image folders that contain the
          # namespace (for example precommit/hadoop).
          # In future, we probably want to encode this information in the boil config metadata per
          # registry so we don't have to do such gymnastics in the workflow.
          image-repository: ${{ inputs.registry-namespace }}/${{ inputs.image-name || inputs.product-name }}
          image-manifest-tag: ${{ steps.build.outputs.image-manifest-tag }}
          source-image-uri: localhost/${{ inputs.registry-namespace }}/${{ inputs.product-name }}:${{ steps.build.outputs.image-manifest-tag }}

      - name: Publish Container Image on quay.io
        if: inputs.publish && inputs.publish-to-quay
        uses: stackabletech/actions/publish-image@d0a8db3ba80e974b872c09cb5311f04e0e78582e # v0.16.1
        with:
          image-registry-uri: quay.io
          image-registry-username: stackable+robot_${{ inputs.registry-namespace }}_github_action_build
          image-registry-password: ${{ secrets.quay-robot-secret }}
          # NOTE (@NickLarsenNZ): This fallback is just for now so we can support both repo level
          # image folders that go under the sdp namespace AND nested image folders that contain the
          # namespace (for example precommit/hadoop).
          # In future, we probably want to encode this information in the boil config metadata per
          # registry so we don't have to do such gymnastics in the workflow.
          image-repository: stackable/${{ inputs.registry-namespace }}/${{ inputs.image-name || inputs.product-name }}
          image-manifest-tag: ${{ steps.build.outputs.image-manifest-tag }}
          source-image-uri: localhost/${{ inputs.registry-namespace }}/${{ inputs.product-name }}:${{ steps.build.outputs.image-manifest-tag }}

  publish_manifests:
    name: Build/Publish ${{ matrix.versions }} Manifests
    needs: [generate_version_dimension, build]
    permissions:
      id-token: write
      contents: read
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        versions: ${{ fromJson(needs.generate_version_dimension.outputs.versions) }}
    steps:
      - name: Checkout Repository
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false

      - name: Publish and Sign Image Index Manifest to oci.stackable.tech
        id: publish-oci
        if: inputs.publish
        uses: stackabletech/actions/publish-image-index-manifest@d0a8db3ba80e974b872c09cb5311f04e0e78582e # v0.16.1
        with:
          image-registry-uri: oci.stackable.tech
          image-registry-username: robot$${{ inputs.registry-namespace }}+github-action-build
          image-registry-password: ${{ secrets.harbor-robot-secret }}
          # NOTE (@NickLarsenNZ): This fallback is just for now so we can support both repo level
          # image folders that go under the sdp namespace AND nested image folders that contain the
          # namespace (for example precommit/hadoop).
          # In future, we probably want to encode this information in the boil config metadata per
          # registry so we don't have to do such gymnastics in the workflow.
          image-repository: ${{ inputs.registry-namespace }}/${{ inputs.image-name || inputs.product-name }}
          image-index-manifest-tag: ${{ matrix.versions }}-stackable${{ inputs.sdp-version }}

      - name: Publish and Sign Image Index Manifest to quay.io
        id: publish-quay
        if: inputs.publish && inputs.publish-to-quay
        uses: stackabletech/actions/publish-image-index-manifest@d0a8db3ba80e974b872c09cb5311f04e0e78582e # v0.16.1
        with:
          image-registry-uri: quay.io
          image-registry-username: stackable+robot_${{ inputs.registry-namespace }}_github_action_build
          image-registry-password: ${{ secrets.quay-robot-secret }}
          # NOTE (@NickLarsenNZ): This fallback is just for now so we can support both repo level
          # image folders that go under the sdp namespace AND nested image folders that contain the
          # namespace (for example precommit/hadoop).
          # In future, we probably want to encode this information in the boil config metadata per
          # registry so we don't have to do such gymnastics in the workflow.
          image-repository: stackable/${{ inputs.registry-namespace }}/${{ inputs.image-name || inputs.product-name }}
          image-index-manifest-tag: ${{ matrix.versions }}-stackable${{ inputs.sdp-version }}

      # Record the pushed index manifest digest(s) for this matrix version so the
      # provenance jobs can pick them up. Matrix jobs cannot expose per-version
      # outputs (they overwrite each other), so we pass the digests through
      # artifacts instead.
      - name: Record image index digests for provenance
        if: inputs.publish
        shell: bash
        env:
          VERSION: ${{ matrix.versions }}
          OCI_DIGEST: ${{ steps.publish-oci.outputs.image-index-manifest-digest }}
          QUAY_DIGEST: ${{ steps.publish-quay.outputs.image-index-manifest-digest }}
        run: |
          set -euo pipefail
          jq -n \
            --arg version "$VERSION" \
            --arg oci "$OCI_DIGEST" \
            --arg quay "$QUAY_DIGEST" \
            '{version: $version, oci_digest: $oci, quay_digest: $quay}' > digests.json

      - name: Upload provenance digests
        if: inputs.publish
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: provenance-digests-${{ matrix.versions }}
          path: digests.json
          retention-days: 1

  # Collect the per-version index manifest digests uploaded by publish_manifests
  # and turn them into a matrix (one entry per version and registry) for the
  # provenance job. This is needed because a matrix job cannot expose per-leg
  # outputs directly.
  collect-provenance-matrix:
    name: Collect Provenance Matrix
    if: inputs.publish
    needs: [publish_manifests]
    permissions:
      contents: read
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.build-matrix.outputs.matrix }}
      has-entries: ${{ steps.build-matrix.outputs.has_entries }}
    steps:
      - name: Download provenance digests
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: provenance-digests-*
          path: artifacts

      - name: Build provenance matrix
        id: build-matrix
        shell: bash
        env:
          REGISTRY_NAMESPACE: ${{ inputs.registry-namespace }}
          PRODUCT_NAME: ${{ inputs.product-name }}
          IMAGE_NAME: ${{ inputs.image-name }}
        run: |
          set -euo pipefail
          IMAGE="${IMAGE_NAME:-$PRODUCT_NAME}"

          # Collect every digests.json regardless of the directory layout that
          # download-artifact produces.
          readarray -t DIGEST_FILES < <(find artifacts -type f -name digests.json)

          # No digests recorded means nothing to attach provenance to. Guard here
          # because jq with no file arguments would block reading from stdin.
          if [ "${#DIGEST_FILES[@]}" -eq 0 ]; then
            echo "matrix={\"include\":[]}" | tee -a "$GITHUB_OUTPUT"
            echo "has_entries=false" | tee -a "$GITHUB_OUTPUT"
            exit 0
          fi

          # Build a JSON matrix include array. Each version contributes one entry
          # for oci.stackable.tech and, if a quay digest was recorded, one for
          # quay.io. The slsa generator attaches provenance by digest, so no tag
          # is needed in the image reference.
          INCLUDE=$(jq -c -s \
            --arg ns "$REGISTRY_NAMESPACE" \
            --arg img "$IMAGE" '
            [ .[]
              | ( { registry: "oci.stackable.tech",
                    image: ("oci.stackable.tech/" + $ns + "/" + $img),
                    digest: .oci_digest,
                    username: ("robot$" + $ns + "+github-action-build") } ),
                ( if (.quay_digest // "") != ""
                  then { registry: "quay.io",
                         image: ("quay.io/stackable/" + $ns + "/" + $img),
                         digest: .quay_digest,
                         username: ("stackable+robot_" + $ns + "_github_action_build") }
                  else empty end )
            ]' "${DIGEST_FILES[@]}")

          echo "matrix={\"include\":$INCLUDE}" | tee -a "$GITHUB_OUTPUT"
          if [ "$INCLUDE" = "[]" ]; then
            echo "has_entries=false" | tee -a "$GITHUB_OUTPUT"
          else
            echo "has_entries=true" | tee -a "$GITHUB_OUTPUT"
          fi

  # Generate SLSA build provenance for every published multi-arch image index
  # (one matrix entry per version and registry) and attach it to the image. The
  # reusable workflow signs the provenance with keyless signing (GitHub Actions
  # as the OIDC identity) and pushes the attestation next to the image.
  provenance:
    name: Generate Provenance (${{ matrix.image }}@${{ matrix.digest }})
    if: inputs.publish && needs.collect-provenance-matrix.outputs.has-entries == 'true'
    needs: [collect-provenance-matrix]
    permissions:
      actions: read # detect the build workflow that generated the image
      id-token: write # mint the OIDC token for keyless signing
      packages: write # needed until https://github.com/slsa-framework/slsa-github-generator/issues/1257 is resolved
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.collect-provenance-matrix.outputs.matrix) }}
    # MUST be referenced by a @vX.Y.Z tag (not a SHA), otherwise the reusable
    # workflow cannot verify its own provenance.
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0
    with:
      image: ${{ matrix.image }}
      digest: ${{ matrix.digest }}
      registry-username: ${{ matrix.username }}
    secrets:
      registry-password: ${{ matrix.registry == 'quay.io' && secrets.quay-robot-secret || secrets.harbor-robot-secret }}

  notify:
    name: Failure Notification
    needs: [generate_version_dimension, build, publish_manifests, collect-provenance-matrix, provenance]
    runs-on: ubuntu-latest
    # TODO (@NickLarsenNZ): Allow a condition from input so that we can always
    # be notified of new builds for precompiled product images.
    if: failure() || (github.run_attempt > 1 && !cancelled())
    steps:
      - name: Send Notification
        uses: stackabletech/actions/send-slack-notification@d0a8db3ba80e974b872c09cb5311f04e0e78582e # v0.16.1
        with:
          publish-manifests-result: ${{ needs.publish_manifests.result }}
          build-result: ${{ needs.build.result }}
          slack-token: ${{ secrets.slack-token }}
          channel-id: C07UG6JH44F # notifications-container-images
          type: container-image-build