wc-build-push.yml

---
name: Build & Push

on:
  workflow_call:
    inputs:
      flavor:
        required: true
        type: string

permissions:
  contents: read

env:
  REGISTRY: ghcr.io

jobs:
  build-push:
    strategy:
      matrix:
        runner: ["ubuntu-latest", "ubuntu-24.04-arm"]
    runs-on: ${{ matrix.runner }}
    permissions:
      packages: write
    steps:
      - uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
        with:
          egress-policy: audit
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false
      - uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
      - uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
        env:
          DOCKER_METADATA_SET_OUTPUT_ENV: false
        id: metadata
        with:
          images: ${{ env.REGISTRY }}/${{ github.repository }}-${{ inputs.flavor }}
      # Generate image LABEL for devcontainer.metadata
      # the sed expression is a workaround for quotes being eaten in arrays (e.g. ["x", "y", "z"] -> ["x",y,"z"])
      - run: echo "metadata=$(jq -cj '[.]' .devcontainer/${{ inputs.flavor }}/devcontainer-metadata-vscode.json | sed 's/,"/, "/g')" >> "$GITHUB_OUTPUT"
        id: devcontainer-metadata
      - run: echo "git-commit-epoch=$(git log -1 --pretty=%ct)" >> "$GITHUB_OUTPUT"
        id: devcontainer-epoch
      - run: echo "arch=${RUNNER_ARCH@L}" >> "$GITHUB_OUTPUT"
        id: devcontainer-arch
      - uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
        id: build-and-push
        env:
          SOURCE_DATE_EPOCH: ${{ steps.devcontainer-epoch.outputs.git-commit-epoch }}
        with:
          file: .devcontainer/${{ inputs.flavor }}/Dockerfile
          push: true
          tags: ${{ env.REGISTRY }}/${{ github.repository }}-${{ inputs.flavor }}
          labels: |
            ${{ steps.metadata.outputs.labels }}
            devcontainer.metadata=${{ steps.devcontainer-metadata.outputs.metadata }}
          annotations: ${{ steps.metadata.outputs.annotations }}
          sbom: true
          outputs: type=image,push-by-digest=true,name-canonical=true
          cache-to: type=gha,mode=max,scope=${{ github.repository }}-${{ inputs.flavor }}-${{ matrix.runner }}
          cache-from: type=gha,scope=${{ github.repository }}-${{ inputs.flavor }}-${{ matrix.runner }}
      - name: Export digest
        run: |
          mkdir -p ${{ runner.temp }}/digests
          digest="${{ steps.build-and-push.outputs.digest }}"
          touch "${{ runner.temp }}/digests/${digest#sha256:}"
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: digests-${{ inputs.flavor }}-${{ steps.devcontainer-arch.outputs.arch }}
          path: ${{ runner.temp }}/digests/*
          if-no-files-found: error
          retention-days: 1

  merge-image:
    runs-on: ubuntu-latest
    needs: build-push
    permissions:
      actions: read
      attestations: write
      # dependency-submission needs contents write permission.
      contents: write
      # attest-build-provenance needs id-token write permission.
      id-token: write
      packages: write
      pull-requests: write
    steps:
      - uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
        with:
          egress-policy: audit
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false
      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          path: ${{ runner.temp }}/digests
          pattern: digests-${{ inputs.flavor }}-*
          merge-multiple: true
      - uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
      - uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
        id: metadata
        env:
          DOCKER_METADATA_ANNOTATIONS_LEVELS: index
          DOCKER_METADATA_SET_OUTPUT_ENV: false
        with:
          images: ${{ env.REGISTRY }}/${{ github.repository }}-${{ inputs.flavor }}
          # Generate Docker tags based on the following events/attributes
          tags: |
            type=edge
            type=ref,event=pr
            type=semver,pattern={{raw}}
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
      - name: Create manifest list and push
        working-directory: ${{ runner.temp }}/digests
        shell: python
        run: |
          import os
          import json
          import subprocess

          CONTAINER = '${{ env.REGISTRY }}/${{ github.repository }}-${{ inputs.flavor }}'
          METADATA = json.loads('${{ steps.metadata.outputs.json }}')

          digests = [f for f in os.listdir('.') if f.startswith('sha256:') or len(f) == 64]

          command = ['docker', 'buildx', 'imagetools', 'create',
              *[annotation for annotation in METADATA.get('annotations', []) for annotation in ('--annotation', annotation)],
              *[tag for tag in METADATA.get('tags', []) for tag in ('--tag', tag)],
              *[f"{CONTAINER}@sha256:{digest}" for digest in digests]
          ]

          print(' '.join(command))
          subprocess.run(command, check=True)
      - name: Inspect manifest and extract digest
        id: inspect-manifest
        run: |
          set -Eeuo pipefail
          output=$(docker buildx imagetools inspect ${{ env.REGISTRY }}/${{ github.repository }}-${{ inputs.flavor }}:${{ steps.metadata.outputs.version }} --format '{{json .}}')
          echo "digest=$(echo "$output" | jq -r '.manifest.digest // .manifests[0].digest')" >> "$GITHUB_OUTPUT"
      - uses: ./.github/actions/container-size-diff
        id: container-size-diff
        with:
          from-container: ${{ env.REGISTRY }}/${{ github.repository }}-${{ inputs.flavor }}:edge
          to-container: ${{ env.REGISTRY }}/${{ github.repository }}-${{ inputs.flavor }}:${{ steps.metadata.outputs.version }}
      - uses: marocchino/sticky-pull-request-comment@67d0dec7b07ed060a405f9b2a64b8ab319fdd7db # v2.9.2
        with:
          header: container-size-diff-${{ inputs.flavor }}
          message: |
            ${{ steps.container-size-diff.outputs.size-diff-markdown }}
      - uses: anchore/sbom-action@9246b90769f852b3a8921f330c59e0b3f439d6e9 # v0.20.1
        with:
          image: ${{ env.REGISTRY }}/${{ github.repository }}-${{ inputs.flavor }}@${{ steps.inspect-manifest.outputs.digest }}
          dependency-snapshot: true
      - uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2.4.0
        with:
          subject-name: ${{ env.REGISTRY }}/${{ github.repository }}-${{ inputs.flavor }}
          subject-digest: ${{ steps.inspect-manifest.outputs.digest }}
          show-summary: false
          push-to-registry: true
      - name: Verify attestation
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh attestation verify --repo ${{ github.repository }} oci://${{ env.REGISTRY }}/${{ github.repository }}-${{ inputs.flavor }}@${{ steps.inspect-manifest.outputs.digest }}