docker.yml

name: Docker Builder
on:
  push:
    branches:
      - main
      - test
  release:
    types: [published]

jobs:
  docker:
    if: ${{ vars.SKIP_DOCKER_JOB != 'true' }}
    runs-on: ubuntu-latest
    permissions:
      id-token: write
    strategy:
      matrix:
        include:
          # --> telegraf
          - TAGNAME: ""
            REPOSITORY: telegraf
            EXTRA_CMAKE_ARGS: ""
            MARCH: ""
            PLATFORM: amd64
            UHD_VERSION: ""
            DPDK_VERSION: ""
            DOCKERFILE: ./docker/telegraf/Dockerfile
            CONTEXT: ./docker/telegraf
            ATTESTATION_FILE: ""
          # --> grafana
          - TAGNAME: ""
            REPOSITORY: grafana
            EXTRA_CMAKE_ARGS: ""
            MARCH: ""
            PLATFORM: amd64
            UHD_VERSION: ""
            DPDK_VERSION: ""
            DOCKERFILE: ./docker/grafana/Dockerfile
            CONTEXT: ./docker/grafana
            ATTESTATION_FILE: ""
          # --> gnb
          # AMD AVX2
          - TAGNAME: release_avx2
            REPOSITORY: srsran-project
            MARCH: x86-64-v3
            PLATFORM: amd64
            UHD_VERSION: "4.7.0.0"
            DPDK_VERSION: "24.11.2"
            DOCKERFILE: ./docker/Dockerfile
            CONTEXT: ./
            ATTESTATION_FILE: /usr/local/etc/srsran_image.spdx
          - TAGNAME: release_with_debug_avx2
            REPOSITORY: srsran-project
            EXTRA_CMAKE_ARGS: -DFORCE_DEBUG_INFO=On
            MARCH: x86-64-v3
            PLATFORM: amd64
            UHD_VERSION: "4.7.0.0"
            DPDK_VERSION: "24.11.2"
            DOCKERFILE: ./docker/Dockerfile
            CONTEXT: ./
            ATTESTATION_FILE: /usr/local/etc/srsran_image.spdx
          # AMD AVX512
          - TAGNAME: release_avx512
            REPOSITORY: srsran-project
            MARCH: x86-64-v4
            PLATFORM: amd64
            UHD_VERSION: "4.7.0.0"
            DPDK_VERSION: "24.11.2"
            DOCKERFILE: ./docker/Dockerfile
            CONTEXT: ./
            ATTESTATION_FILE: /usr/local/etc/srsran_image.spdx
          - TAGNAME: release_with_debug_avx512
            REPOSITORY: srsran-project
            EXTRA_CMAKE_ARGS: -DFORCE_DEBUG_INFO=On
            MARCH: x86-64-v4
            PLATFORM: amd64
            UHD_VERSION: "4.7.0.0"
            DPDK_VERSION: "24.11.2"
            DOCKERFILE: ./docker/Dockerfile
            CONTEXT: ./
            ATTESTATION_FILE: /usr/local/etc/srsran_image.spdx
    env:
      PREFIX: softwareradiosystems/${{ matrix.REPOSITORY }}:${{ matrix.TAGNAME }}
    environment: dockerhub
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Set up cosign
        uses: sigstore/cosign-installer@v3

      - name: Install regctl
        uses: actions/setup-go@v3
        with:
          go-version: '1.x'
      - name: Set up regctl
        run: |
          go install github.com/regclient/regclient/cmd/regctl@latest
        shell: bash

      - name: Determine tags based on branch
        id: tags
        run: |
          BRANCH_NAME="${GITHUB_REF#refs/heads/}"
          DATE_TAG="${GITHUB_SHA:0:10}__$(date +'%Y-%m-%d')"
          RELEASE_NAME_INIT="${{ github.event.release.name }}"
          RELEASE_NAME="${RELEASE_NAME_INIT##* }"

          if [ -n "$RELEASE_NAME" ]; then
            tags="${{ env.PREFIX }}-${DATE_TAG},${{ env.PREFIX }}-${RELEASE_NAME}"
          else
            if [ "$BRANCH_NAME" == "main" ]; then
              tags="${{ env.PREFIX }}-${DATE_TAG},${{ env.PREFIX }}-latest"
            elif [ "$BRANCH_NAME" == "test" ]; then
              tags="${{ env.PREFIX }}-${DATE_TAG},${{ env.PREFIX }}-next"
            fi
          fi
          tags="${tags//:-/:}"
          echo "tags=$tags"
          echo "tags=$tags" >> $GITHUB_OUTPUT

      - name: Login to Docker Hub
        uses: docker/login-action@v3.2.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
          logout: true
          ecr: false

      - name: Build and push
        id: build_and_push
        uses: docker/build-push-action@v6
        with:
          push: true
          tags: ${{ steps.tags.outputs.tags }}
          file: ${{ matrix.DOCKERFILE }}
          platforms: ${{ matrix.PLATFORM }}
          context: ${{ matrix.CONTEXT }}
          build-args: |
            NAME="${{ env.NAME }}"
            UHD_VERSION=${{ matrix.UHD_VERSION }}
            DPDK_VERSION=${{ matrix.DPDK_VERSION }}
            MARCH=${{ matrix.MARCH }}

      - name: Attest image
        if: ${{ matrix.ATTESTATION_FILE != '' }}
        run: |
          IFS=',' read -ra TAG_LIST <<< "${{ steps.tags.outputs.tags }}"
          DIGEST=${{ steps.build_and_push.outputs.digest }}
          
          for IMAGE_TAG in "${TAG_LIST[@]}"; do
            IMAGE_DIGEST="$IMAGE_TAG@$DIGEST"
            regctl image get-file "$IMAGE_TAG" ${{ matrix.ATTESTATION_FILE }} > image.spdx
            cosign attest --predicate image.spdx --type spdx "$IMAGE_DIGEST"
          done
        shell: bash
        env:
          COSIGN_EXPERIMENTAL: 1
          COSIGN_YES: 1