build-docker-images.yml

---
name: Build push and test docker images

on:
  workflow_call:
    inputs:
      product:
        required: true
        description: Product to build
        type: string
      ref:
        description: git ref to checkout
        type: string
        default: master
        required: false
      image-name:
        description: repository name for the requested image
        type: string
        required: true
      image-tags:
        description: tag for the requested image
        type: string
        required: true
      image-description:
        description: short description for the image repository
        type: string
        required: true
      platforms:
        description: target platform(s)
        type: string
        default: linux/arm64/v8,linux/amd64
        required: false
      build-args:
        description: build-time variables
        type: string
        default: ''
        required: false
      push:
        description: push image to DockerHub
        type: boolean
        required: true
    secrets:
      DOCKERHUB_ORGANIZATION_NAME:
        required: true
      DOCKERHUB_USERNAME:
        required: true
      DOCKERHUB_TOKEN:
        required: true

permissions: # least privileges, see https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
  contents: read
  # This is used to complete the identity challenge
  # with sigstore/fulcio when running outside of PRs.
  id-token: write

jobs:
  validate-push-image:
    name: Check only images built from tags and master are pushed
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
          submodules: recursive
          ref: ${{ inputs.ref }}
          persist-credentials: false
      - name: validate reference only if image will be pushed
        if: ${{ inputs.push }}
        env:
          REF: ${{ inputs.ref }}
        run: |
          [[ "${REF}" == "master" ]] || git describe --tags --exact-match

  prepare-runner-os-list:
    name: generate list of runner-architecture pairs based on the input "platforms"
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    outputs:
      runnerlist: ${{ steps.get-runnerlist.outputs.runnerlist }}
    steps:
      - run: sudo apt-get update && sudo apt-get -y install jo
      - id: get-runnerlist
        env:
          INPUT_PLATFORMS: ${{ inputs.platforms }}"
        run: |
          runner_os_arch=()
          echo $INPUT_PLATFORMS | grep -qq arm64 && runner_os_arch+=($(jo arch=linux/amd64 runner=ubuntu-24.04))
          echo $INPUT_PLATFORMS | grep -qq arm64 && runner_os_arch+=($(jo arch=linux/arm64 runner=ubuntu-24.04-arm))
          echo "runnerlist=$(jo -a ${runner_os_arch[@]})" >> "$GITHUB_OUTPUT"

  build:
    name: build ${{ matrix.platform.arch }} docker image for a product
    runs-on: ${{ matrix.platform.runner }}
    needs:
      - validate-push-image
      - prepare-runner-os-list
    strategy:
      fail-fast: false
      matrix:
        platform: ${{ fromJson(needs.prepare-runner-os-list.outputs.runnerlist) }}
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
          submodules: recursive
          ref: ${{ inputs.ref }}
          persist-credentials: false
      - name: Set up Docker Buildx for multi-platform builds
        uses: docker/setup-buildx-action@v4
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4
      - name: Login to Docker Hub
        if: ${{ inputs.push }}
        uses: docker/login-action@v4
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Docker image metadata
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: ${{ secrets.DOCKERHUB_ORGANIZATION_NAME || 'powerdns' }}/${{ inputs.image-name }}
      - name: Build and load powerdns product images
        id: build-image
        uses: docker/build-push-action@v7
        with:
          context: .
          file: Dockerfile-${{ inputs.product }}
          platforms: ${{ matrix.platform.arch }}
          push: ${{ inputs.push }}
          sbom: true
          tags: ${{ secrets.DOCKERHUB_ORGANIZATION_NAME || 'powerdns' }}/${{ inputs.image-name }}
          build-args: ${{ inputs.build-args }}
          outputs: type=image,push-by-digest=true,name-canonical=true
      - name: Update repo description
        if: ${{ inputs.push }}
        uses: peter-evans/dockerhub-description@v5
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
          repository: ${{ secrets.DOCKERHUB_ORGANIZATION_NAME }}/${{ inputs.image-name }}
          short-description: ${{ inputs.image-description }}
      - name: Export output digest
        env:
          ARCH: ${{ matrix.platform.arch }}
          DIGEST: ${{ steps.build-image.outputs.digest }}
        run: |
          mkdir -p $RUNNER_TEMP/digests
          touch "$RUNNER_TEMP/digests/${DIGEST#sha256:}"
          # generate suffix for digest file
          echo "PLATFORM_PAIR=${ARCH//\//-}" >> $GITHUB_ENV
      - name: Upload digest
        uses: actions/upload-artifact@v7
        with:
          name: digests-${{ inputs.product }}-${{ env.PLATFORM_PAIR }}
          path: ${{ runner.temp }}/digests/*
          if-no-files-found: error
          retention-days: 1

  publish-tag:
    name: Generate and publish tag for multi-platform image
    runs-on: ubuntu-24.04
    if: ${{ inputs.push }}
    needs: build
    permissions:
      contents: read
      # This is used to complete the identity challenge
      # with sigstore/fulcio when running outside of PRs.
      id-token: write
    outputs:
      image-digest: ${{ steps.get-image-digest.outputs.image-digest }}
    env:
      IMAGE_NAME: ${{ secrets.DOCKERHUB_ORGANIZATION_NAME }}/${{ inputs.image-name }}
    steps:
      - name: Install cosign
        uses: sigstore/cosign-installer@v4.1.2
      - name: Download digests
        uses: actions/download-artifact@v8
        with:
          path: ${{ runner.temp }}/digests
          pattern: digests-${{ inputs.product }}-*
          merge-multiple: true
      - name: Login to Docker Hub
        if: ${{ inputs.push }}
        uses: docker/login-action@v4
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4
      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: ${{ env.IMAGE_NAME }}
          tags: ${{ inputs.image-tags }}
      - name: Create manifest list and push
        working-directory: ${{ runner.temp }}/digests
        run: |
          docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
            $(printf $IMAGE_NAME'@sha256:%s ' *)
      - name: Get image digest
        id: get-image-digest
        env:
          TAG: ${{ steps.meta.outputs.version }}
        run: |
          echo "image-digest=$(docker buildx imagetools inspect $IMAGE_NAME:$TAG --format="{{json .Manifest}}" | jq -r .digest)" >> "$GITHUB_OUTPUT"
      - name: Sign product image
        id: sign-image
        env:
          TAG: |
            ${{ env.IMAGE_NAME }}@${{ steps.get-image-digest.outputs.image-digest }}
        # This step uses the identity token to provision an ephemeral certificate
        # against the sigstore community Fulcio instance.
        run: cosign sign --yes ${TAG}

  test-uploaded-images:
    name: test ${{ matrix.platform.arch }} uploaded images
    if: ${{ inputs.push }}
    needs:
      - prepare-runner-os-list
      - publish-tag
    runs-on: ${{ matrix.platform.runner }}
    strategy:
      matrix:
        platform: ${{ fromJson(needs.prepare-runner-os-list.outputs.runnerlist) }}
      fail-fast: false
    env:
      INPUT_IMAGE_TAGS: ${{ inputs.image-tags }}
      INPUT_PLATFORMS: ${{ inputs.platforms }}
      IMAGE_NAME: ${{ secrets.DOCKERHUB_ORGANIZATION_NAME }}/${{ inputs.image-name }}
    permissions:
      contents: read
    steps:
      - name: Check running image
        run: |
          for tag in `echo "${INPUT_IMAGE_TAGS}" | tr '\n' ' '`; do
            echo 'Testing: '${IMAGE_NAME}':'${tag};
            # recent pdns-auth images of tags older than 4.9.x image return an exit code 99
            docker run ${IMAGE_NAME}:${tag} --version || [ "$?" == "99" ]
          done
      - name: Check image digest matches
        env:
          EXPECTED_DIGEST: ${{ needs.publish-tag.outputs.image-digest }}
        run: |
          for tag in `echo "${INPUT_IMAGE_TAGS}" | tr '\n' ' '`; do
            image_digest=$(docker inspect --format='{{index .RepoDigests 0}}' ${IMAGE_NAME}:${tag} | cut -d '@' -f 2)
            [[ "${EXPECTED_DIGEST}" == "${image_digest}" ]] || \
              ( echo "Image digest does not match => expected_digest: "${EXPECTED_DIGEST}" - actual_digest: "${image_digest} && exit 1 )
          done
      - name: Check SBOM and Provenance
        run: |
          for tag in `echo "${INPUT_IMAGE_TAGS}" | tr '\n' ' '`; do
            if $(echo "${INPUT_PLATFORMS}" | grep -qq ','); then
              docker buildx imagetools inspect ${IMAGE_NAME}:${tag} --format "{{json .Provenance}}" | jq -e '."linux/'$(dpkg --print-architecture)'" | has("SLSA")'
              docker buildx imagetools inspect ${IMAGE_NAME}:${tag} --format "{{json .SBOM}}" | jq -e '."linux/'$(dpkg --print-architecture)'" | has("SPDX")'
            else
              docker buildx imagetools inspect ${IMAGE_NAME}:${tag} --format "{{json .Provenance}}" | jq -e 'has("SLSA")'
              docker buildx imagetools inspect ${IMAGE_NAME}:${tag} --format "{{json .SBOM}}" | jq -e 'has("SPDX")'
            fi
          done