Build GCC and push, with digest only

Author: Bronek

.github/workflows/debian.yml

@@ -4,7 +4,7 @@ on:
   push:
     paths:
       - .github/workflows/debian.yml
-      - docker/debian/Dockerfile
+      - docker/debian/Dockerfile*
       - test
   workflow_dispatch:
 
@@ -96,6 +96,38 @@ jobs:
             echo "CONTAINER_REPOSITORY_GCC=${CONTAINER_REPO}/debian-gcc" >> $GITHUB_ENV
             echo "CONTAINER_IMAGE_GCC=${CONTAINER_REGISTRY}/${CONTAINER_REPO}/debian-gcc" >> $GITHUB_ENV
           fi
+      - name: Prepare gcc image metadata
+        if: ${{ env.CONTAINER_IMAGE_GCC }}
+        id: meta-gcc
+        uses: docker/metadata-action@v5
+        env:
+          DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,manifest-descriptor
+        with:
+          images: ${{ env.CONTAINER_IMAGE_GCC }}
+          labels: |
+            org.opencontainers.image.authors=For inquiries, please use https://${{ github.repository }}/issues
+            org.opencontainers.image.documentation=https://${{ github.repository }}
+            org.opencontainers.image.vendor=XRPLF
+            org.opencontainers.image.title=${{ env.CONTAINER_REPOSITORY_GCC }}
+      - name: Build gcc image
+        # Note, we always push this image, otherwise steps.build will fail.
+        # Also, because we always push it, we intentionally do not tag it.
+        # TODO: Move to separate workflow or job
+        if: ${{ env.CONTAINER_IMAGE_GCC }}
+        id: build-gcc
+        uses: docker/build-push-action@v6
+        with:
+          build-args: |
+             BUILDKIT_DOCKERFILE_CHECK=skip=InvalidDefaultArgInFrom
+             BUILDKIT_INLINE_CACHE=1
+          context: .
+          file: docker/debian/Dockerfile.gcc-${{ matrix.os.compiler_version }}-${{ matrix.os.release }}
+          outputs: type=image,name=${{ env.CONTAINER_IMAGE_GCC }},push-by-digest=true,name-canonical=true,push=true
+          platforms: ${{ matrix.architecture.platform }}
+          provenance: mode=max
+          push: true
+          sbom: true
+          labels: ${{ steps.meta-gcc.outputs.labels }}
       - name: Prepare container metadata
         id: meta
         uses: docker/metadata-action@v5
@@ -124,7 +156,7 @@ jobs:
             GCOVR_VERSION=${{ env.GCOVR_VERSION }}
             CMAKE_VERSION=${{ env.CMAKE_VERSION }}
             DEBIAN_VERSION=${{ matrix.os.release }}
-            BASE_IMAGE=${{ env.CONTAINER_IMAGE_GCC && format('{0}:{1}-{2}', env.CONTAINER_IMAGE_GCC, matrix.os.compiler_version, matrix.os.release) || format('gcc:{0}-{1}', matrix.os.compiler_version, matrix.os.release) }}
+            BASE_IMAGE=${{ env.CONTAINER_IMAGE_GCC && format('{0}@{1}', steps.build-gcc.outputs.digest) || format('gcc:{0}-{1}', matrix.os.compiler_version, matrix.os.release) }}
           context: .
           file: docker/debian/Dockerfile
           outputs: type=image,name=${{ env.CONTAINER_IMAGE }},push-by-digest=true,name-canonical=true,push=true