_build-cell.yml

# SPDX-License-Identifier: MIT
# Copyright (c) 2026 Netresearch DTT GmbH
#
# Reusable workflow: build the GLPI image for both arches and merge them into
# one multi-arch manifest list, with SLSA provenance, an in-image SBOM, and
# keyless cosign signatures. Called from build.yml's `build` job.
#
# Native amd64 + arm64 runners (no QEMU) each push their layer BY DIGEST; the
# merge job joins the two digests into a single tagged manifest list, attests
# it, and cosign-signs the index + per-arch children.

name: _build-cell

on:
  workflow_call:
    inputs:
      version: {type: string, required: true}
      major: {type: string, required: true}
      major_minor: {type: string, required: true}
      glpi_sha256: {type: string, required: true}
      build_date: {type: string, required: true}
      date_tag: {type: string, required: true}
      registry: {type: string, required: true}
      image_name: {type: string, required: true}
      is_main_ref: {type: boolean, required: true}
      is_release_from_file: {type: boolean, required: true}
      push_artifacts: {type: boolean, required: true}

permissions:
  contents: read

jobs:
  build:
    name: build (${{ matrix.platform.arch }})
    runs-on: ${{ matrix.platform.runner }}
    permissions:
      contents: read
      packages: write
      id-token: write
      attestations: write
    strategy:
      fail-fast: false
      matrix:
        platform:
          - arch: amd64
            runner: ubuntu-latest
          - arch: arm64
            runner: ubuntu-24.04-arm   # native arm64 — no QEMU emulation
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0

      - name: Log in to ghcr.io
        if: inputs.push_artifacts
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ${{ inputs.registry }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build (by digest — tags attached by the merge job)
        id: build
        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          context: .
          platforms: linux/${{ matrix.platform.arch }}
          target: runtime
          outputs: type=image,name=${{ inputs.registry }}/${{ inputs.image_name }},push-by-digest=true,name-canonical=true,push=${{ inputs.push_artifacts }}
          build-args: |
            GLPI_VERSION=${{ inputs.version }}
            GLPI_SHA256=${{ inputs.glpi_sha256 }}
            BUILD_DATE=${{ inputs.build_date }}
            VCS_REF=${{ github.sha }}
          provenance: mode=max
          sbom: true
          cache-from: type=gha,scope=glpi-${{ matrix.platform.arch }}
          cache-to: type=gha,scope=glpi-${{ matrix.platform.arch }},mode=max

      - name: Attest per-arch image
        if: inputs.push_artifacts
        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
        with:
          subject-name: ${{ inputs.registry }}/${{ inputs.image_name }}
          subject-digest: ${{ steps.build.outputs.digest }}
          push-to-registry: true

      - name: Export per-arch digest
        if: inputs.push_artifacts
        env:
          DIGEST: ${{ steps.build.outputs.digest }}
        run: |
          mkdir -p /tmp/digests
          touch "/tmp/digests/${DIGEST#sha256:}"

      - name: Upload per-arch digest artifact
        if: inputs.push_artifacts
        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
        with:
          name: digests-${{ matrix.platform.arch }}
          path: /tmp/digests/*
          if-no-files-found: error
          retention-days: 1

  # ─ Merge per-arch digests into one tagged multi-arch manifest list ─────
  merge:
    name: merge
    if: inputs.push_artifacts && !cancelled()
    needs: build
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      id-token: write
      attestations: write
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Download per-arch digests
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          path: /tmp/digests
          pattern: digests-*
          merge-multiple: true

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0

      - name: Log in to ghcr.io
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ${{ inputs.registry }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Compute image tags
        id: tags
        env:
          REF_VERSION: ${{ inputs.version }}
          REF_DATE_TAG: ${{ inputs.date_tag }}
          REF_MAJOR_MINOR: ${{ inputs.major_minor }}
          REF_MAJOR: ${{ inputs.major }}
          IS_RELEASE_FROM_FILE: ${{ inputs.is_release_from_file }}
          IS_MAIN_REF: ${{ inputs.is_main_ref }}
        run: |
          # `latest` / floating major(.minor) tags only when building the
          # pinned release from .glpi-version on the main branch — never from
          # a manual workflow_dispatch override.
          ENABLE_FLOATING="false"
          if [ "$IS_RELEASE_FROM_FILE" = "true" ] && [ "$IS_MAIN_REF" = "true" ]; then
            ENABLE_FLOATING="true"
          fi
          {
            echo "tags<<__EOF__"
            echo "type=raw,value=${REF_VERSION}"
            echo "type=raw,value=${REF_VERSION}-${REF_DATE_TAG}"
            echo "type=raw,value=${REF_MAJOR_MINOR},enable=${ENABLE_FLOATING}"
            echo "type=raw,value=${REF_MAJOR},enable=${ENABLE_FLOATING}"
            echo "type=raw,value=latest,enable=${ENABLE_FLOATING}"
            echo "type=sha,prefix=sha-"
            echo "__EOF__"
          } >> "$GITHUB_OUTPUT"

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
        with:
          images: ${{ inputs.registry }}/${{ inputs.image_name }}
          tags: ${{ steps.tags.outputs.tags }}

      - name: Create + push multi-arch manifest list
        id: manifest
        env:
          IMAGE: ${{ inputs.registry }}/${{ inputs.image_name }}
          METADATA_JSON: ${{ steps.meta.outputs.json }}
        run: |
          set -euo pipefail
          mapfile -t TAG_FLAGS < <(jq -r '.tags[] | "--tag=\(.)"' <<<"$METADATA_JSON")
          mapfile -t SRC_REFS < <(
            find /tmp/digests -maxdepth 1 -type f -printf "${IMAGE}@sha256:%f\n"
          )
          # Expect exactly 2 per-arch digests (amd64 + arm64). Fewer means an
          # arch build failed silently — fail loudly rather than publish a
          # degenerate single-arch image under the multi-arch tag.
          if [ "${#SRC_REFS[@]}" -ne 2 ]; then
            echo "ERROR: expected 2 per-arch digests, got ${#SRC_REFS[@]}" >&2
            printf '  %s\n' "${SRC_REFS[@]}" >&2
            exit 1
          fi
          echo "tags:";    printf '  %s\n' "${TAG_FLAGS[@]}"
          echo "sources:"; printf '  %s\n' "${SRC_REFS[@]}"
          docker buildx imagetools create \
              --metadata-file /tmp/manifest-metadata.json \
              "${TAG_FLAGS[@]}" "${SRC_REFS[@]}"
          # buildx --metadata-file uses the nested descriptor.digest key;
          # the // fallback covers the flat key in case the schema changes.
          MANIFEST_DIGEST=$(jq -r '
              ."containerimage.descriptor".digest //
              ."containerimage.digest" // empty
          ' /tmp/manifest-metadata.json)
          if [ -z "$MANIFEST_DIGEST" ] || [ "$MANIFEST_DIGEST" = "null" ]; then
            echo "ERROR: failed to capture manifest digest" >&2
            cat /tmp/manifest-metadata.json >&2
            exit 1
          fi
          echo "digest=$MANIFEST_DIGEST" >> "$GITHUB_OUTPUT"

      - name: Attest build provenance (multi-arch manifest)
        if: steps.manifest.outputs.digest != ''
        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
        with:
          subject-name: ${{ inputs.registry }}/${{ inputs.image_name }}
          subject-digest: ${{ steps.manifest.outputs.digest }}
          push-to-registry: true

      # attest-build-provenance (HOW it was built, in-toto SLSA predicate) and
      # cosign sign (WHO/WHAT workflow signed it, OIDC-bound) are complementary
      # — both land in Rekor; consumers may verify either or both.
      - name: Install cosign
        if: steps.manifest.outputs.digest != ''
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2

      - name: Sign manifest + per-arch children (keyless / OIDC)
        if: steps.manifest.outputs.digest != ''
        env:
          IMAGE_REF: ${{ inputs.registry }}/${{ inputs.image_name }}@${{ steps.manifest.outputs.digest }}
        run: |
          # --recursive also signs each child manifest, so arch-pinned
          # `cosign verify ...@<per-arch-digest>` keeps working.
          cosign sign --recursive --yes "$IMAGE_REF"