image-build.yml

name: image-build

# On Pull Requests, only want to build image to make sure build isn't broken, don't push to quay.io.
# On Push to main (in repo, not forks), want to build and push image to quay.io.
on: # yamllint disable-line rule:truthy
  pull_request:
    branches: ["*"]
    paths:
      - "**/*.go"
      - "**/Containerfile.*"
      - config/**/*.yaml
  push:
    branches: [main]
    tags:
      - v*
    paths:
      - "**/*.go"
      - "**/Containerfile.*"
      - config/**/*.yaml

jobs:
  build-and-push-images:
    permissions:
      contents: read
      packages: write
      id-token: write # needed for signing the images with GitHub OIDC Token

    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        image:
          - registry: quay.io
            repository: gkm
            image: gkm-operator
            dockerfile: ./Containerfile.gkm-operator
            context: .
            tags: |
              type=ref,event=branch
              type=ref,event=tag
              type=ref,event=pr
              type=sha,format=long
              # set latest tag for default branch
              type=raw,value=latest,enable={{is_default_branch}}

          - registry: quay.io
            repository: gkm
            image: gkm-agent-nogpu
            dockerfile: ./Containerfile.gkm-agents
            context: .
            target: nogpu
            tags: |
              type=ref,event=branch
              type=ref,event=tag
              type=ref,event=pr
              type=sha,format=long
              # set latest tag for default branch
              type=raw,value=latest,enable={{is_default_branch}}
          - registry: quay.io
            repository: gkm
            image: gkm-agent-nvidia
            dockerfile: ./Containerfile.gkm-agents
            context: .
            target: nvidia
            tags: |
              type=ref,event=branch
              type=ref,event=tag
              type=ref,event=pr
              type=sha,format=long
              # set latest tag for default branch
              type=raw,value=latest,enable={{is_default_branch}}
          - registry: quay.io
            repository: gkm
            image: gkm-agent-amd
            dockerfile: ./Containerfile.gkm-agents
            context: .
            target: amd
            tags: |
              type=ref,event=branch
              type=ref,event=tag
              type=ref,event=pr
              type=sha,format=long
              # set latest tag for default branch
              type=raw,value=latest,enable={{is_default_branch}}
          - registry: quay.io
            repository: gkm
            image: gkm-extract
            dockerfile: ./Containerfile.gkm-extract
            context: .
            tags: |
              type=ref,event=branch
              type=ref,event=tag
              type=ref,event=pr
              type=sha,format=long
              # set latest tag for default branch
              type=raw,value=latest,enable={{is_default_branch}}

    name: Build Image (${{ matrix.image.image }})
    steps:
      # Set a `push_flag`. This is only true if the github action is a push and the repository
      # organization is `redhat-et`. This keeps credential fails from occurring on push to forks.
      - name: Set push flag
        id: set-push
        run: |
          if [ ${{ github.event_name }} == 'push' ] && [ ${{ github.repository_owner }} == 'redhat-et' ]; then
            echo "push_flag=true" >> "$GITHUB_OUTPUT"
          else
            echo "push_flag=false" >> "$GITHUB_OUTPUT"
          fi

      # TO BE REMOVED: Leaving in to verify values on a push to a fork of repository.
      - name: Debug
        run: |
          echo "The event that triggered this workflow is ${{ github.event_name }}."
          echo "The matrix.image.repository is ${{ matrix.image.repository }}."
          echo "The ref_name is: ${{ github.ref_name }}"
          echo "The head_ref branch is: ${{ github.head_ref }}"
          echo "The organization is: ${{ github.repository_owner }}"
          echo "The PUSH_FLAG is: ${{ fromJSON(steps.set-push.outputs.push_flag) }}"

      - name: Checkout GKM
        uses: actions/checkout@v6

      - name: Install cosign
        if: ${{ fromJSON(steps.set-push.outputs.push_flag) }}
        uses: sigstore/cosign-installer@v4.1.0

      - name: Login to quay.io/gkm
        uses: redhat-actions/podman-login@v1
        if: ${{ fromJSON(steps.set-push.outputs.push_flag) }}
        with:
          registry: ${{ matrix.image.registry }}
          username: ${{ secrets.GKM_USERNAME }}
          password: ${{ secrets.GKM_ROBOT_TOKEN }}

      - name: Extract metadata (tags, labels) for image
        id: meta
        uses: docker/metadata-action@v6.0.0
        with:
          images: ${{ matrix.image.registry }}/${{ matrix.image.repository }}/${{ matrix.image.image }}
          tags: ${{ matrix.image.tags }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Build and push
        id: build-push-image
        uses: docker/build-push-action@v7
        with:
          platforms: linux/amd64
          # platforms: linux/amd64, linux/arm64, linux/ppc64le, linux/s390x
          # builds with rocm will fail on linux/arm64
          push: ${{ fromJSON(steps.set-push.outputs.push_flag) }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          file: ${{ matrix.image.dockerfile }}
          build-args: BUILDPLATFORM=linux/amd64
          context: ${{ matrix.image.context }}
          target: ${{ matrix.image.target || '' }}

      - name: Sign the images with GitHub OIDC Token
        if: ${{ fromJSON(steps.set-push.outputs.push_flag) }}
        run: |
          readarray -t tags <<<"${{ steps.meta.outputs.tags }}"
          for tag in ${tags[@]}; do
            cosign sign -y "${tag}@${{ steps.build-push-image.outputs.digest }}"
          done