images.yaml

name: Build images

on:
  pull_request:
    branches: ['main']
  push:
    branches: ['main']
    tags: ['v[0-9]+.[0-9]+.[0-9]+*']

jobs:
  build-images:
    concurrency:
      # If a previous run is ongoing with the same head_ref (it's a run on the
      # same PR) then cancel it to save time. If it isn't a PR, only cancel the
      # previous run if it's on the same commit SHA. This prevents a run for a
      # commit push from cancelling a previous commit push's build, since we
      # want an image built and tagged for each commit.
      group: build-images-${{ matrix.image }}-${{ github.head_ref || github.sha }}
      cancel-in-progress: true
    permissions:
      contents: read  # Read the repo contents.
      id-token: write # Produce identity token for keyless signing.
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        image:
        - executor
        - executor-debug
        - executor-slim
        - warmer

        include:

        
        - image: executor
          target: kaniko-executor
          platforms: linux/amd64,linux/arm64,linux/s390x,linux/ppc64le
          image-name: martizih/kaniko
          tag: ${{ github.sha }}
          release-tag: latest

        - image: executor-debug
          target: kaniko-debug
          platforms: linux/amd64,linux/arm64,linux/s390x
          image-name: martizih/kaniko
          tag: ${{ github.sha }}-debug
          release-tag: debug

        - image: executor-slim
          target: kaniko-slim
          platforms: linux/amd64,linux/arm64,linux/s390x,linux/ppc64le
          image-name: martizih/kaniko
          tag: ${{ github.sha }}-slim
          release-tag: slim

        - image: warmer
          target: kaniko-warmer
          platforms: linux/amd64,linux/arm64,linux/s390x,linux/ppc64le
          image-name: martizih/kaniko
          tag: ${{ github.sha }}-warmer
          release-tag: warmer

    steps:
    - uses: actions/checkout@b0e28b5ac45a892f91e7d036f8200cf5ed489415 # v3

    # Setup auth if not a PR.
    - if: github.event_name != 'pull_request'
      uses: docker/login-action@v3
      with:
        username: ${{ vars.DOCKERHUB_USERNAME }}
        password: ${{ secrets.DOCKERHUB_TOKEN }}

    # Don't build for all platforms on PRs.
    - id: platforms
      run: |
        event="${{ github.event_name }}"
        if [[ "$event" == "pull_request" ]]; then
          echo "platforms=linux/amd64" >> $GITHUB_OUTPUT
        else
          platforms="${{ matrix.platforms }}"
          echo "platforms=${platforms}" >> $GITHUB_OUTPUT
        fi
    # Build and push with Docker.
    - uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
      with:
        platforms: ${{ matrix.platforms }}
    - uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v1
    - uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
      id: build-and-push
      with:
        context: .
        file: ./deploy/Dockerfile
        platforms: ${{ steps.platforms.outputs.platforms }}
        push: ${{ github.event_name != 'pull_request' }} # Only push if not a PR.
        tags: ${{ matrix.image-name }}:${{ matrix.tag }}
        no-cache-filters: certs
        # https://github.com/docker/build-push-action/blob/master/docs/advanced/cache.md#github-cache
        cache-from: type=gha
        cache-to: type=gha,mode=max
        target: ${{ matrix.target }}

    # Sign images if not a PR.
    - if: github.event_name != 'pull_request'
      uses: sigstore/cosign-installer@3454372f43399081ed03b604cb2d021dabca52bb # v3.8.2
    - if: github.event_name != 'pull_request'
      run: |
        cosign sign --yes \
            ${{ matrix.image-name }}@${{ steps.build-and-push.outputs.digest }}

    # If a tag push, use crane to add more tags.
    - if: startsWith(github.ref, 'refs/tags/v')
      uses: imjasonh/setup-crane@31b88efe9de28ae0ffa220711af4b60be9435f6e # v0.4
    - if: startsWith(github.ref, 'refs/tags/v')
      name: Apply release tags
      run: |
        tag=${GITHUB_REF/refs\/tags\//}

        # Tag :latest, :debug, :slim
        crane cp ${{ matrix.image-name }}@${{ steps.build-and-push.outputs.digest }} \
            ${{ matrix.image-name }}:${{ matrix.release-tag }}

        if [[ "${{ matrix.release-tag }}" == "latest" ]]; then
          # Tag :latest images as :v1.X.Y
          crane cp ${{ matrix.image-name }}@${{ steps.build-and-push.outputs.digest }} \
              ${{ matrix.image-name }}:${tag}
        else
          # Or tag :v1.X.Y-debug and :v1.X.Y-slim
          crane cp ${{ matrix.image-name }}@${{ steps.build-and-push.outputs.digest }} \
              ${{ matrix.image-name }}:${tag}-${{ matrix.release-tag }}
        fi