docker-publish.yml

---
name: Docker build and push to quay

on:
  push:
    branches: ["main"]
    # Publish semver tags as releases.
    tags: ["v*.*.*"]
  pull_request:
    branches: ["main"]

  workflow_dispatch:

  repository_dispatch:
    types: [dependency-updated]

env:
  # Use docker.io for Docker Hub if empty
  REGISTRY: quay.io
  # Generic image name for build artifacts, will be retagged for specific repos
  QUAY_IMAGE_NAME: localhost/utility-container

jobs:
  test:
    uses: ./.github/workflows/container-test.yml

  build-container:
    needs: [test]
    strategy:
      matrix:
        include:
          - targetarch: amd64
            runner: ubuntu-latest
            platform: linux/amd64
            alttargetarch: x86_64
            opttargetarch: ""
            extrarpms: ""
          - targetarch: arm64
            runner: ubuntu-24.04-arm
            platform: linux/arm64
            alttargetarch: aarch64
            opttargetarch: "arm64-"
            extrarpms: "gcc python3-devel glibc-devel libxcrypt-devel"

    runs-on: ${{ matrix.runner }}
    permissions:
      contents: read

    steps:
      - name: Checkout repository
        uses: actions/checkout@v5

      # Set up BuildKit Docker container builder for docker save functionality
      # https://github.com/docker/setup-buildx-action
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1

      # https://github.com/docker/build-push-action
      # Build Docker image with Buildx. We always disable the cache as
      # it sometimes would not pull the new git changes for the cluster_utils,v1
      - name: Build Docker image
        id: build-and-push
        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
        with:
          context: .
          file: Containerfile
          platforms: ${{ matrix.platform }}
          push: false
          tags: ${{ env.REGISTRY }}/${{ env.QUAY_IMAGE_NAME }}:build-${{ github.run_id }}-${{ matrix.targetarch }}
          no-cache: true
          outputs: type=docker,dest=/tmp/image-${{ matrix.targetarch }}.tar
          build-args: |
            TARGETARCH=${{ matrix.targetarch }}
            ALTTARGETARCH=${{ matrix.alttargetarch }}
            OPTTARGETARCH=${{ matrix.opttargetarch }}
            EXTRARPMS=${{ matrix.extrarpms }}

      # Upload image as artifact
      - name: Upload image artifact
        if: github.event_name != 'pull_request'
        uses: actions/upload-artifact@v4
        with:
          name: image-${{ matrix.targetarch }}-${{ github.run_id }}
          path: /tmp/image-${{ matrix.targetarch }}.tar
          retention-days: 1

  create-multiarch-manifest:
    needs: [build-container]
    if: github.event_name != 'pull_request'
    strategy:
      matrix:
        include:
          - image_name: validatedpatterns/utility-container
            username_secret: QUAY_USERNAME
            password_secret: QUAY_PASSWORD
          - image_name: hybridcloudpatterns/utility-container
            username_secret: LEGACY_QUAY_USERNAME
            password_secret: LEGACY_QUAY_PASSWORD

    runs-on: ubuntu-latest
    permissions:
      contents: read
      # This is used to complete the identity challenge
      # with sigstore/fulcio when running outside of PRs.
      id-token: write

    steps:
      # Download image artifacts
      - name: Download AMD64 image
        uses: actions/download-artifact@v4
        with:
          name: image-amd64-${{ github.run_id }}
          path: /tmp/

      - name: Download ARM64 image
        uses: actions/download-artifact@v4
        with:
          name: image-arm64-${{ github.run_id }}
          path: /tmp/

      # Load images into Docker and retag for this repo
      - name: Load and retag images
        run: |
          docker load --input /tmp/image-amd64.tar
          docker load --input /tmp/image-arm64.tar

          # Retag loaded images for this specific repo
          OLD_IMAGE_BASE="${{ env.REGISTRY }}/${{ env.QUAY_IMAGE_NAME }}"
          NEW_IMAGE_BASE="${{ env.REGISTRY }}/${{ matrix.image_name }}"

          docker tag "${OLD_IMAGE_BASE}:build-${{ github.run_id }}-amd64" "${NEW_IMAGE_BASE}:build-${{ github.run_id }}-amd64"
          docker tag "${OLD_IMAGE_BASE}:build-${{ github.run_id }}-arm64" "${NEW_IMAGE_BASE}:build-${{ github.run_id }}-arm64"

      # Install the cosign tool
      # https://github.com/sigstore/cosign-installer
      - name: Install cosign
        uses: sigstore/cosign-installer@d58896d6a1865668819e1d91763c7751a165e159 # v3.9.2
        with:
          cosign-release: "v2.2.4"

      - name: Log into registry ${{ env.REGISTRY }}
        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ secrets[matrix.username_secret] }}
          password: ${{ secrets[matrix.password_secret] }}

      # Push individual architecture images to registry
      - name: Push architecture-specific images
        run: |
          IMAGE_BASE="${{ env.REGISTRY }}/${{ matrix.image_name }}"
          docker push "${IMAGE_BASE}:build-${{ github.run_id }}-amd64"
          docker push "${IMAGE_BASE}:build-${{ github.run_id }}-arm64"

      # Extract metadata for multi-arch manifest
      - name: Extract Docker metadata for manifest
        id: meta
        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
        with:
          images: ${{ env.REGISTRY }}/${{ matrix.image_name }}
          flavor: |
            latest=${{ github.ref == 'refs/heads/main' }}

      # Create and push multi-arch manifest
      - name: Create and push multi-arch manifest
        id: push-manifest
        run: |
          IMAGE_BASE="${{ env.REGISTRY }}/${{ matrix.image_name }}"

          # Get the tags from metadata
          TAGS="${{ steps.meta.outputs.tags }}"

          for TAG in $TAGS; do
            echo "Creating manifest for: $TAG"

            # Use docker buildx imagetools to create multi-arch manifest
            docker buildx imagetools create -t "$TAG" \
              "${IMAGE_BASE}:build-${{ github.run_id }}-amd64" \
              "${IMAGE_BASE}:build-${{ github.run_id }}-arm64"
          done

          # Get the digest of the first tag for signing
          FIRST_TAG=$(echo "$TAGS" | head -n1)
          DIGEST=$(docker buildx imagetools inspect "$FIRST_TAG" --format '{{json .}}' | jq -r '.manifest.digest')
          echo "digest=$DIGEST" >> "$GITHUB_OUTPUT"

      # Sign the resulting Docker image digest
      # This will only write to the public Rekor transparency log when the Docker
      # repository is public to avoid leaking data.  If you would like to publish
      # transparency data even for private images, pass --force to cosign below.
      # https://github.com/sigstore/cosign
      - name: Sign the published Docker image
        env:
          # https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
          TAGS: ${{ steps.meta.outputs.tags }}
          DIGEST: ${{ steps.push-manifest.outputs.digest }}
        # This step uses the identity token to provision an ephemeral certificate
        # against the sigstore community Fulcio instance.
        run: echo "${TAGS}" | xargs -I "{}" cosign sign --yes "{}@${DIGEST}"

      # Clean up temporary architecture-specific images
      - name: Clean up temporary images
        if: always()
        run: |
          IMAGE_BASE="${{ env.REGISTRY }}/${{ matrix.image_name }}"

          # Try to delete temporary images, ignore errors if they don't exist
          docker run --rm quay.io/skopeo/stable delete \
            --creds "${{ secrets[matrix.username_secret] }}:${{ secrets[matrix.password_secret] }}" \
            docker://"${IMAGE_BASE}:build-${{ github.run_id }}-amd64" || true

          docker run --rm quay.io/skopeo/stable delete \
            --creds "${{ secrets[matrix.username_secret] }}:${{ secrets[matrix.password_secret] }}" \
            docker://"${IMAGE_BASE}:build-${{ github.run_id }}-arm64" || true