build.yaml

name: Build
on:
  pull_request:
    types:
      - opened
      - synchronize
  push:
    branches:
      - main
    tags:
      - "*"
env:
  QUAY_STACKROX_IO_RW_USERNAME: ${{ secrets.QUAY_STACKROX_IO_RW_USERNAME }}
  QUAY_STACKROX_IO_RW_PASSWORD: ${{ secrets.QUAY_STACKROX_IO_RW_PASSWORD }}
  QUAY_RHACS_ENG_RW_USERNAME: ${{ secrets.QUAY_RHACS_ENG_RW_USERNAME }}
  QUAY_RHACS_ENG_RW_PASSWORD: ${{ secrets.QUAY_RHACS_ENG_RW_PASSWORD }}

jobs:

  build-and-push-builder-images:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        image-flavor:
          - scanner-build
          - stackrox-build
          - stackrox-ui-test
          - jenkins-plugin
      fail-fast: false
    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          fetch-depth: 0
          ref: ${{ github.event.pull_request.head.sha }}
      - uses: ./.github/actions/build-and-push-image
        id: build-and-push-image
        with:
          image-flavor: "${{ matrix.image-flavor }}"
      - name: Push latest tag
        if: startsWith(github.ref, 'refs/tags/')
        run: |
          if ! git merge-base --is-ancestor "${{ github.sha }}" origin/main; then
            echo "Skipping latest push: tagged commit is not on main"
            exit 0
          fi
          CURRENT="${{ github.ref_name }}"
          LATEST="$(git tag --merged origin/main --sort=-version:refname | head -1)"
          if [[ "${CURRENT}" != "${LATEST}" ]]; then
            echo "Skipping latest push: ${CURRENT} is not the highest version tag on main (${LATEST} is)"
            exit 0
          fi
          IMAGE="${{ steps.build-and-push-image.outputs.image-tag }}"
          LATEST_IMAGE="quay.io/stackrox-io/apollo-ci:${{ matrix.image-flavor }}-latest"
          docker tag "${IMAGE}" "${LATEST_IMAGE}"
          docker push "${LATEST_IMAGE}"
      - name: Save image info
        run: |
          mkdir -p image-info
          echo "${{ steps.build-and-push-image.outputs.image-tag }}" > "image-info/${{ matrix.image-flavor }}.txt"
      - name: Upload image info
        uses: actions/upload-artifact@v4
        with:
          name: image-info-${{ matrix.image-flavor }}
          path: image-info/${{ matrix.image-flavor }}.txt
          retention-days: 1

  build-and-push-test-images:
    needs: build-and-push-builder-images
    runs-on: ubuntu-latest
    strategy:
      matrix:
        image-flavor:
          - stackrox-test
          - scanner-test
      fail-fast: false
    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          fetch-depth: 0
          ref: ${{ github.event.pull_request.head.sha }}
      - uses: ./.github/actions/build-and-push-image
        id: build-and-push-image
        with:
          image-flavor: "${{ matrix.image-flavor }}"
      - name: Push latest tag
        if: startsWith(github.ref, 'refs/tags/')
        run: |
          if ! git merge-base --is-ancestor "${{ github.sha }}" origin/main; then
            echo "Skipping latest push: tagged commit is not on main"
            exit 0
          fi
          CURRENT="${{ github.ref_name }}"
          LATEST="$(git tag --merged origin/main --sort=-version:refname | head -1)"
          if [[ "${CURRENT}" != "${LATEST}" ]]; then
            echo "Skipping latest push: ${CURRENT} is not the highest version tag on main (${LATEST} is)"
            exit 0
          fi
          IMAGE="${{ steps.build-and-push-image.outputs.image-tag }}"
          LATEST_IMAGE="quay.io/stackrox-io/apollo-ci:${{ matrix.image-flavor }}-latest"
          docker tag "${IMAGE}" "${LATEST_IMAGE}"
          docker push "${LATEST_IMAGE}"
      - name: Save image info
        run: |
          mkdir -p image-info
          echo "${{ steps.build-and-push-image.outputs.image-tag }}" > "image-info/${{ matrix.image-flavor }}.txt"
      - name: Upload image info
        uses: actions/upload-artifact@v4
        with:
          name: image-info-${{ matrix.image-flavor }}
          path: image-info/${{ matrix.image-flavor }}.txt
          retention-days: 1

  test-cci-export:
    runs-on: ubuntu-latest
    needs:
      - build-and-push-builder-images
      - build-and-push-test-images
    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          fetch-depth: 0
          ref: ${{ github.event.pull_request.head.sha }}
      - name: Test cci-export in a context similar to how it is used in CI
        run: |
          docker login -u "$QUAY_STACKROX_IO_RW_USERNAME" --password-stdin <<<"$QUAY_STACKROX_IO_RW_PASSWORD" quay.io
          make test-cci-export

  comment-build-images:
    runs-on: ubuntu-latest
    needs:
      - build-and-push-builder-images
      - build-and-push-test-images
    steps:
      - name: Download all image info artifacts
        uses: actions/download-artifact@v4
        with:
          pattern: image-info-*
          merge-multiple: true
          path: image-info
      - name: Build comment message
        id: build-message
        run: |
          echo "message<<EOF" >> $GITHUB_OUTPUT
          echo "## Build Images" >> $GITHUB_OUTPUT
          echo "" >> $GITHUB_OUTPUT
          echo "| Image Flavor | Image Tag |" >> $GITHUB_OUTPUT
          echo "|--------------|-----------|" >> $GITHUB_OUTPUT
          for file in image-info/*.txt; do
            if [ -f "$file" ]; then
              flavor=$(basename "$file" .txt)
              image=$(cat "$file")
              echo "| ${flavor} | \`${image}\` |" >> $GITHUB_OUTPUT
            fi
          done
          echo "EOF" >> $GITHUB_OUTPUT
      - name: Comment PR with build images
        if: ${{ github.event_name == 'pull_request' }}
        uses: thollander/actions-comment-pull-request@v3
        with:
          message: ${{ steps.build-message.outputs.message }}
          comment-tag: build-images
      - name: Print the comment message to step summary
        run: |
          # Need to cat here, because echo would interpret the backticks in the message as commands.
          cat >> $GITHUB_STEP_SUMMARY << 'EOF'
          ${{ steps.build-message.outputs.message }}
          EOF