.build.yml

# reusable workflow
name: .build

on:
  workflow_call:
    inputs:
      name:
        required: true
        type: string
      envs:
        required: false
        type: string
      release:
        required: false
        type: string
      distros:
        required: false
        type: string

env:
  REPO_SLUG: dockereng/packaging
  BUILD_CACHE_REGISTRY_SLUG: dockereng/packaging-cache
  DOCKER_BUILD_SUMMARY: false

jobs:
  prepare:
    runs-on: ubuntu-24.04
    outputs:
      includes: ${{ steps.matrix.outputs.includes }}
    steps:
      -
        name: Checkout
        uses: actions/checkout@v6
      -
        name: Matrix
        id: matrix
        uses: actions/github-script@v8
        env:
          INPUT_NAME: ${{ inputs.name }}
          INPUT_RELEASE: ${{ inputs.release }}
          INPUT_DISTROS: ${{ inputs.distros }}
        with:
          script: |
            const inpName = core.getInput('name');
            const inpRelease = core.getInput('release');
            const inpDistros = core.getInput('distros');
            let distroFilter = [];
            if (inpDistros) {
              distroFilter = inpDistros
                .split(',')
                .map(d => d.trim())
                .filter(d => d !== '');
            }
            
            if (inpRelease !== '' && !['pushonly', 'draft', 'prerelease', 'release'].includes(inpRelease)) {
              throw new Error(`Invalid release type: ${inpRelease}`);
            }
            
            let def = {};
            await core.group(`Parsing definition`, async () => {
              const resPrint = await exec.getExecOutput('docker', ['buildx', 'bake', 'pkg', '--print'], {
                ignoreReturnCode: true
              });
              if (resPrint.stderr.length > 0 && resPrint.exitCode != 0) {
                throw new Error(resPrint.stderr);
              }
              def = JSON.parse(resPrint.stdout.trim());
            });
            
            await core.group(`Generating matrix`, async () => {
              const includes = [];
              for (const targetName of Object.keys(def.target)) {
                if (!targetName.startsWith(`pkg-${inpName}`)) {
                  continue;
                }
                const match = targetName.match(/^pkg-(.+)-([^-]+)$/);
                if (!match) {
                  throw new Error(`Invalid target name: ${targetName}`);
                }
                const pkgName = match[1];
                const distro = match[2];
                // Skip distros that don't match the input distro filter
                if (distroFilter.length > 0 && !distroFilter.includes(distro)) {
                  core.info(`Skipping ${targetName} because it doesn't match the input distro filter`);
                  continue;
                }
                const target = def.target[targetName];
                if (target.platforms && target.platforms.length > 0) {
                  target.platforms.forEach(platform => {
                    includes.push({
                      distro: distro,
                      platform: platform,
                      runner: platform.startsWith('linux/arm') ? 'ubuntu-24.04-arm' : 'ubuntu-24.04',
                      // FIXME: we can't verify platforms not native to the runner as it would segfault through emulation
                      verify: platform.startsWith('linux/386') || platform.startsWith('linux/amd64') || platform.startsWith('linux/arm64')
                    });
                  });
                } else {
                  // if no platforms are returned, this means this package does
                  // not support a distro so we skip it.
                }
              }
              core.info(JSON.stringify(includes, null, 2));
              core.setOutput('includes', JSON.stringify(includes));
            });

  build:
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 20
    needs:
      - prepare
    strategy:
      fail-fast: false
      matrix:
        include: ${{ fromJson(needs.prepare.outputs.includes) }}
    steps:
      -
        name: Checkout
        uses: actions/checkout@v6
      -
        name: Environment variables
        run: |
          for l in "${{ inputs.envs }}"; do
            echo "${l?}" >> $GITHUB_ENV
          done
      -
        name: Prepare
        # Set platform pair for artifact upload
        run: |
          platform=${{ matrix.platform }}
          echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
      -
        name: Set up QEMU
        uses: docker/setup-qemu-action@v3
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          version: latest
      -
        name: Build
        uses: docker/bake-action@v6
        with:
          source: .
          targets: pkg-${{ inputs.name }}-${{ matrix.distro }}
          set: |
            *.platform=${{ matrix.platform }}
        env:
          RH_USER: ${{ secrets.RH_USER }}
          RH_PASS: ${{ secrets.RH_PASS }}
      -
        name: List artifacts
        run: |
          tree -nh ./bin/pkg/${{ inputs.name }}
      -
        name: Verify
        if: ${{ matrix.verify }}
        uses: docker/bake-action@v6
        with:
          source: .
          targets: verify-${{ inputs.name }}-${{ matrix.distro }}
          set: |
            *.platform=${{ matrix.platform }}
      -
        name: Upload artifacts
        uses: actions/upload-artifact@v6
        with:
          name: build-pkg-${{ inputs.name }}-${{ matrix.distro }}-${{ env.PLATFORM_PAIR }}
          path: ./bin/pkg/${{ inputs.name }}/*
          if-no-files-found: error
          retention-days: 1

  release:
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    needs:
      - build
    steps:
      -
        name: Checkout
        uses: actions/checkout@v6
      -
        name: Environment variables
        run: |
          for l in "${{ inputs.envs }}"; do
            echo "${l?}" >> $GITHUB_ENV
          done
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          version: latest
      -
        name: Download artifacts
        uses: actions/download-artifact@v6
        with:
          path: ./bin/pkg/${{ inputs.name }}
          pattern: build-pkg-${{ inputs.name }}-*
          merge-multiple: true
      -
        name: List artifacts
        run: |
          tree -nh ./bin/pkg/${{ inputs.name }}
      -
        name: Generate metadata
        uses: docker/bake-action@v6
        with:
          source: .
          targets: metadata-${{ inputs.name }}
          provenance: false
      -
        name: Resolve metadata
        run: |
          for l in $(cat ./bin/pkg/${{ inputs.name }}/metadata.env); do
            export "${l?}"
            echo "${l?}" >> $GITHUB_ENV
          done
          if [ "${{ github.event_name }}" = "schedule" ]; then
            echo "GIT_TAG=nightly/${{ inputs.name }}/$VERSION" >> $GITHUB_ENV
          else
            echo "GIT_TAG=${{ inputs.name }}/$VERSION" >> $GITHUB_ENV
          fi
      -
        name: Docker meta
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: |
            ${{ env.REPO_SLUG }}
          tags: |
            type=ref,event=pr
            type=raw,value=${{ env.GIT_TAG }}
            type=raw,value=${{ env.GIT_TAG }}-${{ github.run_number }}
          labels: |
            com.github.docker.packaging.event_name=${{ github.event_name }}
            com.github.docker.packaging.run_id=${{ github.run_id }}
            com.github.docker.packaging.run_number=${{ github.run_number }}
          bake-target: meta-helper
      -
        name: Login to Docker Hub
        uses: docker/login-action@v3
        if: ${{ inputs.release || github.event_name == 'schedule' }}
        with:
          username: ${{ secrets.DOCKERPUBLICBOT_USERNAME }}
          password: ${{ secrets.DOCKERPUBLICBOT_WRITE_PAT }}
      -
        name: Build release
        id: build
        uses: docker/bake-action@v6
        with:
          source: .
          files: |
            ./docker-bake.hcl
            ${{ steps.meta.outputs.bake-file-tags }}
            ${{ steps.meta.outputs.bake-file-annotations }}
          targets: release-${{ inputs.name }}
          provenance: false
          set: |
            *.output=type=image,oci-mediatypes=true,push=${{ inputs.release != '' || github.event_name == 'schedule' }}
            *.output=/tmp/release
      -
        name: List release artifacts
        run: |
          mkdir -p /tmp/release-squashed
          cp ./bin/pkg/${{ inputs.name }}/metadata.env /tmp/release-squashed/
          find /tmp/release -mindepth 2 -maxdepth 2 ! -name metadata.env -exec cp -r -t /tmp/release-squashed {} +
          tree -nh /tmp/release-squashed | tee /tmp/packages.txt
          rm -rf /tmp/release-squashed
      -
        name: Prepare release
        run: |
          cat > "/tmp/release-metadata.json" <<-EOF
          ${{ steps.build.outputs.metadata }}
          EOF
          
          for tag in $(jq -r '.tags[]' <<< "$DOCKER_METADATA_OUTPUT_JSON"); do
            echo "* \`${tag}\`" >> /tmp/tags.txt
          done
          
          cat > "/tmp/summary.txt" <<-EOF
          * repo: ${REPO}
          * ref: \`${REF}\`
          * version: \`${VERSION}\`
          * commit: [\`${COMMIT}\`](${REPO}/commit/${COMMIT})
          EOF

          if [ "${{ inputs.name }}" = "containerd" ]; then
            cat >> "/tmp/summary.txt" <<-EOF
          * runc
            * repo: ${RUNC_REPO}
            * ref: \`${RUNC_REF}\`
            * version: \`${RUNC_VERSION}\`
            * commit: [\`${RUNC_COMMIT}\`](${RUNC_REPO}/commit/${RUNC_COMMIT})
          * runhcs
            * repo: ${RUNHCS_REPO}
            * ref: \`${RUNHCS_REF}\`
            * version: \`${RUNHCS_VERSION}\`
            * commit: [\`${RUNHCS_COMMIT}\`](${RUNHCS_REPO}/commit/${RUNHCS_COMMIT})
          EOF
          fi
          
          cat >> "/tmp/summary.txt" <<-EOF
          * packages: \`$(find /tmp/release -type f | wc -l)\` files
          * size: \`$(du -sh /tmp/release | awk '{print $1}')\`
          EOF
          
          cat >> "$GITHUB_STEP_SUMMARY" <<-EOF
          # Package build
          
          ## Tags
          $(cat /tmp/tags.txt)
          
          ## Summary
          $(cat /tmp/summary.txt)
          EOF
      -
        name: Set outputs
        uses: actions/github-script@v8
        id: release-metadata
        with:
          script: |
            const fs = require('fs');
            core.setOutput('tags', fs.readFileSync('/tmp/tags.txt', {encoding: 'utf8'}));
            core.setOutput('summary', fs.readFileSync('/tmp/summary.txt', {encoding: 'utf8'}));
      -
        name: Create release
        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b  # v2.5.0
        if: ${{ inputs.release && inputs.release != 'pushonly' }}
        with:
          name: ${{ env.GIT_TAG }}-${{ github.run_number }}
          draft: ${{ inputs.release == 'draft' }}
          prerelease: ${{ inputs.release == 'prerelease' }}
          tag_name: ${{ env.GIT_TAG }}-${{ github.run_number }}
          target_commitish: ${{ github.sha }}
          files: |
            /tmp/packages.txt
            ./bin/pkg/${{ inputs.name }}/metadata.env
            /tmp/release-metadata.json
          body: |
            Image available at [https://hub.docker.com/r/${{ env.REPO_SLUG }}](https://hub.docker.com/r/${{ env.REPO_SLUG }}).

            ## Tags
            ${{ steps.release-metadata.outputs.tags }}

            ## Summary
            ${{ steps.release-metadata.outputs.summary }}

            ## Usage
            Extract with [Undock](https://github.com/crazy-max/undock):
            ```console
            $ undock --wrap --rm-dist --all ${{ env.REPO_SLUG }}:${{ steps.meta.outputs.version }} ./${{ inputs.name }}/${{ env.VERSION }}
            ```
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}