build-plus.yml

name: Build Plus

on:
  workflow_call:
    inputs:
      platforms:
        required: true
        type: string
      image:
        required: true
        type: string
      tag:
        required: false
        type: string
      go-md5:
        required: true
        type: string
      base-image-md5:
        required: false
        type: string
      branch:
        required: false
        type: string
      nap-modules:
        required: false
        type: string
      target:
        required: true
        type: string
      authenticated:
        required: true
        type: boolean
      full-build:
        description: Always build base image
        type: boolean
        default: false
      ic-version:
        required: false
        type: string
      runner:
        type: string
        default: ubuntu-24.04
      write-to-cache:
        required: false
        type: boolean
        default: false
      read-from-cache:
        description: Whether to read from cache when building images
        required: false
        type: boolean
        default: true

defaults:
  run:
    shell: bash

permissions:
  contents: read

jobs:
  build:
    name: "${{ contains(inputs.image, 'nap') && 'NAP' || 'Plus' }} ${{ inputs.image }}, ${{ inputs.target }}, ${{inputs.platforms }}, ${{ inputs.nap-modules != '' && inputs.nap-modules || 'plus' }}"
    permissions:
      contents: read # for docker/build-push-action to read repo content
      id-token: write # for OIDC login to AWS
      pull-requests: write # for scout report
    if: github.repository == 'nginx/kubernetes-ingress'
    runs-on: ${{ inputs.runner }}
    steps:
      - name: Checkout Repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          ref: ${{ inputs.branch }}
          fetch-depth: 0

      - name: Azure login
        uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0
        with:
          client-id: ${{ secrets.AZURE_VAULT_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_VAULT_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_VAULT_SUBSCRIPTION_ID }}
        if: ${{ inputs.authenticated }}

      - name: Setup secrets
        id: secrets
        run: |
          echo "Setting secrets for job"
          GCR_WORKLOAD_ID=$(az keyvault secret show --name gcr-workload-identity --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv)
          echo "::add-mask::$GCR_WORKLOAD_ID"
          echo "GCR_WORKLOAD_ID=$GCR_WORKLOAD_ID" >> $GITHUB_OUTPUT
          GCR_SERVICE_ACCOUNT=$(az keyvault secret show --name kic-pipeline-gcr-sa --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv)
          echo "::add-mask::$GCR_SERVICE_ACCOUNT"
          echo "GCR_SERVICE_ACCOUNT=$GCR_SERVICE_ACCOUNT" >> $GITHUB_OUTPUT
          PLUS_CREDS=$(az keyvault secret show --name plus-creds --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv)
          echo "::add-mask::$PLUS_CREDS"
          IFS=@ CERT=$(echo $PLUS_CREDS | jq -r '.crt')
          while read -r line; do
            echo "::add-mask::${line}"
          done <<< "${CERT}"
          echo $CERT > nginx-repo.crt
          IFS=@ KEY=$(echo $PLUS_CREDS | jq -r '.key')
          while read -r line; do
            echo "::add-mask::${line}"
          done <<< "${KEY}"
          echo $KEY > nginx-repo.key
          IFS=@ RHEL_CREDS=$(az keyvault secret show --name rhel-creds --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv)
          while read -r line; do
            echo "::add-mask::${line}"
          done <<< "${RHEL_CREDS}"
          echo $RHEL_CREDS > rhel_license
        if: ${{ inputs.authenticated }}

      - name: Azure login Common Vault
        uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0
        with:
          client-id: ${{ secrets.AZURE_COMMON_VAULT_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_COMMON_VAULT_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_COMMON_VAULT_SUBSCRIPTION_ID }}
        if: ${{ inputs.authenticated }}

      - name: Setup secrets - Common Vault
        id: secrets-common
        run: |
          echo "Setting secrets for job"
          DOCKER_USERNAME=$(az keyvault secret show --name docker-username --vault-name ${{ secrets.COMMON_KEYVAULT_NAME }} --query value -o tsv)
          echo "::add-mask::$DOCKER_USERNAME"
          echo "DOCKER_USERNAME=$DOCKER_USERNAME" >> $GITHUB_OUTPUT
          DOCKER_PASSWORD=$(az keyvault secret show --name docker-password --vault-name ${{ secrets.COMMON_KEYVAULT_NAME }} --query value -o tsv)
          echo "::add-mask::$DOCKER_PASSWORD"
          echo "DOCKER_PASSWORD=$DOCKER_PASSWORD" >> $GITHUB_OUTPUT
        if: ${{ inputs.authenticated }}

      - name: Authenticate to Google Cloud
        id: auth
        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
        with:
          token_format: access_token
          workload_identity_provider: ${{ steps.secrets.outputs.GCR_WORKLOAD_ID }}
          service_account: ${{ steps.secrets.outputs.GCR_SERVICE_ACCOUNT }}
        if: ${{ inputs.authenticated }}

      - name: Login to GCR
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: gcr.io
          username: oauth2accesstoken
          password: ${{ steps.auth.outputs.access_token }}
        if: ${{ inputs.authenticated }}

      - name: DockerHub Login
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          username: ${{ steps.secrets-common.outputs.DOCKER_USERNAME }}
          password: ${{ steps.secrets-common.outputs.DOCKER_PASSWORD }}
        if: ${{ inputs.authenticated }}

      - name: NAP modules
        id: nap_modules
        run: |
          [[ "${{ inputs.nap-modules }}" == "waf,dos" ]] && modules="waf-dos" || name="${{ inputs.nap-modules }}"
          echo "name=${name}" >> $GITHUB_OUTPUT
          [[ "${{ inputs.nap-modules }}" == "waf,dos" ]] && modules="both" || modules="${{ inputs.nap-modules }}"
          echo "modules=${modules}" >> $GITHUB_OUTPUT
        if: ${{ inputs.nap-modules != '' }}

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
        with:
          images: |
            name=gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/dev/nginx-ic${{ contains(inputs.nap-modules, 'dos') && '-dos' || '' }}${{ contains(inputs.nap-modules, 'waf') && '-nap' || '' }}${{ contains(inputs.image, 'v5') && '-v5' || '' }}/nginx-plus-ingress
          flavor: |
            suffix=${{ contains(inputs.image, 'ubi-10') && '-ubi' || '' }}${{ contains(inputs.image, 'alpine') && '-alpine' || '' }}${{ contains(inputs.target, 'aws') && '-mktpl' || '' }}${{ contains(inputs.image, 'fips') && '-fips' || ''}}${{ contains(inputs.image, 'agent') && '-agent' || ''}}
          tags: |
            type=raw,value=${{ inputs.tag }}
          labels: |
            org.opencontainers.image.description=NGINX Plus Ingress Controller for Kubernetes
        env:
          DOCKER_METADATA_ANNOTATIONS_LEVELS: ${{ contains(inputs.target, 'aws') && 'manifest' || 'manifest,index' }}

      - name: Set base name variable
        id: base_name
        run: |
          base_image="gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/dev/nginx-ic-base/plus:${{ inputs.base-image-md5 }}-${{ inputs.image }}${{ steps.nap_modules.outputs.name != '' && format('-{0}', steps.nap_modules.outputs.name) || '' }}${{ contains(inputs.image, 'v5') && '-v5' || '' }}"
          echo "image=${base_image}" >> $GITHUB_OUTPUT

      - name: Check if images exist
        id: images_exist
        run: |
          if docker pull ${{ steps.base_name.outputs.image }}; then
            echo "base_exists=true" >> $GITHUB_OUTPUT
          fi
          if docker manifest inspect ${{ steps.meta.outputs.tags }}; then
            echo "target_exists=true" >> $GITHUB_OUTPUT
          fi
        if: ${{ inputs.authenticated && ! inputs.full-build }}

      - name: Setup QEMU
        uses: ./.github/actions/setup-qemu-cached
        if: ${{ steps.images_exist.outputs.base_exists != 'true' || steps.images_exist.outputs.target_exists != 'true' }}

      - name: Docker Buildx
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
        if: ${{ steps.images_exist.outputs.base_exists != 'true' || steps.images_exist.outputs.target_exists != 'true' }}

      - name: Build Base Container
        uses: ./.github/actions/build-push-retry
        with:
          file: build/Dockerfile
          context: "."
          cache-to: ${{ inputs.write-to-cache && format('type=gha,scope={0}{1},mode=max', inputs.image, steps.nap_modules.outputs.name != '' && format('-{0}', steps.nap_modules.outputs.name) || '' ) || '' }}
          target: common
          tags: ${{ steps.base_name.outputs.image }}
          platforms: ${{ inputs.platforms }}
          pull: true
          push: true
          no-cache: true
          build-args: |
            BUILD_OS=${{ inputs.image }}
            IC_VERSION=${{ inputs.ic-version && inputs.ic-version || steps.meta.outputs.version }}
            ${{ inputs.nap-modules != '' && format('NAP_MODULES={0}', steps.nap_modules.outputs.name) || '' }}
          secret-files: |
            nginx-repo.crt=nginx-repo.crt
            nginx-repo.key=nginx-repo.key
            ${{ inputs.nap-modules != '' && contains(inputs.image, 'ubi') && 'rhel_license=rhel_license' || '' }}
        if: ${{ inputs.authenticated && steps.images_exist.outputs.base_exists != 'true' }}

      - name: Debug values
        run: |
          echo "authenticated: ${{ inputs.authenticated }}"
          echo "images_exist: ${{ steps.images_exist.outputs.base_exists }}"
          echo "target_exists: ${{ steps.images_exist.outputs.target_exists }}"
          echo "full-build: ${{ inputs.full-build }}"

      - name: Fetch Cached Artifacts
        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: ${{ github.workspace }}/dist
          key: nginx-ingress-${{ inputs.go-md5 }}
          fail-on-cache-miss: true
        if: ${{ steps.images_exist.outputs.base_exists != 'true' || steps.images_exist.outputs.target_exists != 'true' }}

      - name: Build Docker image
        uses: ./.github/actions/build-push-retry
        id: build-push
        with:
          file: build/Dockerfile
          context: "."
          cache-from: ${{ inputs.read-from-cache && format('type=gha,scope={0}{1}', inputs.image, steps.nap_modules.outputs.name != '' && format('-{0}', steps.nap_modules.outputs.name) || '' ) || '' }}
          cache-to: ${{ inputs.write-to-cache && format('type=gha,scope={0}{1},mode=max', inputs.image, steps.nap_modules.outputs.name != '' && format('-{0}', steps.nap_modules.outputs.name) || '' ) || '' }}
          target: ${{ inputs.target }}${{ inputs.authenticated && '-prebuilt' || '' }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          annotations: ${{ steps.meta.outputs.annotations }}
          platforms: ${{ inputs.platforms }}
          load: false
          push: ${{ inputs.authenticated }}
          pull: true
          sbom: ${{ inputs.authenticated && !contains(inputs.target, 'aws') }}
          provenance: false
          build-args: |
            BUILD_OS=${{ inputs.image }}
            ${{ inputs.authenticated && format('PREBUILT_BASE_IMG={0}', steps.base_name.outputs.image ) || '' }}
            IC_VERSION=${{ inputs.ic-version && inputs.ic-version || steps.meta.outputs.version }}
            ${{ inputs.nap-modules != '' && format('NAP_MODULES={0}', steps.nap_modules.outputs.name) || '' }}
            ${{ (contains(inputs.target, 'aws') && inputs.nap-modules != '') && format('NAP_MODULES_AWS={0}', steps.nap_modules.outputs.modules) || '' }}
          secret-files: |
            nginx-repo.crt=nginx-repo.crt
            nginx-repo.key=nginx-repo.key
            ${{ contains(inputs.image, 'ubi') && 'rhel_license=rhel_license' || '' }}
        if: ${{  steps.images_exist.outputs.base_exists != 'true' || steps.images_exist.outputs.target_exists != 'true' }}

      - name: Make directory for security scan results
        run: |
          mkdir -p "${{ inputs.image }}-results/"
        if: ${{ inputs.authenticated && steps.build-push.conclusion == 'success' }}

      - name: Run Docker Scout vulnerability scanner
        id: docker-scout
        uses: docker/scout-action@7520205ff60037fdc436b40b6a1d1e55a839ec2d # v1.22.0
        with:
          command: cves
          image: ${{ steps.meta.outputs.tags }}
          ignore-base: true
          sarif-file: "${{ inputs.image }}-results/scout.sarif"
          write-comment: false
          github-token: ${{ secrets.GITHUB_TOKEN }} # to be able to write the comment
          summary: true
        continue-on-error: true
        if: ${{ inputs.authenticated && steps.build-push.conclusion == 'success' }}

      - name: Clean up secrets
        run: |
          rm -f nginx-repo.crt nginx-repo.key rhel_license
        if: always()