reusable-build.yml

name: Reusable Build and Push
on:
  workflow_call:
    inputs:
      image_flavors:
        description: "JSON string of flavors to build, '[main, nvidia]'"
        default: "['main', 'nvidia-open']"
        type: string
      brand_name:
        description: "The Brand Name: bluefin"
        required: true
        default: bluefin
        type: string
      stream_name:
        description: "The Fedora Version: stable, latest, or beta"
        required: true
        type: string
      kernel_pin:
        description: "The full kernel version to pin"
        type: string

env:
  IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }}

concurrency:
  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}-${{ inputs.brand_name}}-${{ inputs.stream_name }}
  cancel-in-progress: true

permissions: {}

jobs:
  build_container:
    name: image
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      packages: write
      id-token: write
      attestations: write
      artifact-metadata: write
    continue-on-error: false
    strategy:
      fail-fast: false
      matrix:
        image_flavor: ${{ fromJson(inputs.image_flavors) }}
        base_name: ["${{ inputs.brand_name }}", "${{ inputs.brand_name }}-dx"]
        stream_name: ["${{ inputs.stream_name }}"]

    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          submodules: recursive

      - name: Maximize build space
        uses: ublue-os/remove-unwanted-software@695eb75bc387dbcd9685a8e72d23439d8686cba6 # v10

      - name: Install Just
        run: |
          /home/linuxbrew/.linuxbrew/bin/brew install just
          echo "/home/linuxbrew/.linuxbrew/bin" >> $GITHUB_PATH

      - name: Check Just Syntax
        shell: bash
        run: |
          just check

      - name: Image Name
        shell: bash
        run: |
          IMAGE_NAME="$(just image_name ${{ matrix.base_name }} ${{ matrix.stream_name }} ${{ matrix.image_flavor }})"
          echo "IMAGE_NAME=${IMAGE_NAME}" >> $GITHUB_ENV

      - name: Default Tag
        shell: bash
        run: |
          DEFAULT_TAG="$(just generate-default-tag \
                       ${{ matrix.stream_name }} \
                       "1")"
          echo "Default Tag: ${DEFAULT_TAG}"
          echo "DEFAULT_TAG=${DEFAULT_TAG}" >> $GITHUB_ENV

      - name: DNF Package Cache Setup
        shell: bash
        id: setup-cache
        env:
          MATRIX_BASE_NAME: ${{ matrix.base_name }}
          MATRIX_STREAM_NAME: ${{ matrix.stream_name }}
          GITHUB_EVENT_NAME: ${{ github.event_name }}
        run: |
          CACHE="$(just setup-cache "${MATRIX_BASE_NAME}" \
                            "${MATRIX_STREAM_NAME}" \
                            "1" \
                            "${GITHUB_EVENT_NAME}")"

          CACHE_NAME="$(echo "${CACHE}" | cut -d' ' -f 1)"
          ALLOW_CACHE_WRITE="$(echo "${CACHE}" | cut -d' ' -f 2)"

          echo "cache_name=${CACHE_NAME}" >> "$GITHUB_OUTPUT"
          echo "allow_cache_write=${ALLOW_CACHE_WRITE}" >> "$GITHUB_OUTPUT"

      - name: Restore DNF package cache
        uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
        env:
          CACHE_NAME: ${{ steps.setup-cache.outputs.cache_name }}
        with:
          path: /var/tmp/buildah-cache-*
          key: ${{ runner.os }}-${{ runner.arch }}-buildah-${{ env.CACHE_NAME }}

      - name: Build Image
        id: build-image
        shell: bash
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          sudo -E $(command -v just) repo_organization="${{ github.repository_owner }}" \
                    build-ghcr "${{ matrix.base_name }}" \
                               "${{ matrix.stream_name }}" \
                               "${{ matrix.image_flavor }}" \
                               "${{ inputs.kernel_pin }}"

      # https://github.com/actions/cache/issues/1533
      - name: Hack around permission issue caching
        shell: bash
        id: cache-perms
        run: |
          sudo chmod 777 --recursive /var/tmp/buildah-cache-0

      - name: Write new DNF package cache
        if: steps.setup-cache.outputs.allow_cache_write == 'true'
        uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
        env:
          CACHE_NAME: ${{ steps.setup-cache.outputs.cache_name }}
        with:
          path: /var/tmp/buildah-cache-*
          key: ${{ runner.os }}-${{ runner.arch }}-buildah-${{ env.CACHE_NAME }}

      - name: Setup Syft
        id: setup-syft
        if: github.event_name != 'pull_request'
        uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0
        with:
          syft-version: v1.39.0

      - name: Generate SBOM
        if: github.event_name != 'pull_request'
        id: generate-sbom
        env:
          MATRIX_BASE_NAME: ${{ matrix.base_name }}
          MATRIX_STREAM_NAME: ${{ matrix.stream_name }}
          MATRIX_IMAGE_FLAVOR: ${{ matrix.image_flavor }}
          SYFT_CMD: ${{ steps.setup-syft.outputs.cmd }}
        run: |
          sudo -E $(command -v just) gen-sbom "${MATRIX_BASE_NAME}" \
                            "${MATRIX_STREAM_NAME}" \
                            "${MATRIX_IMAGE_FLAVOR}" \
                            "${SYFT_CMD}"

      - name: Rechunk Image
        id: rechunk-image
        shell: bash
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          sudo -E $(command -v just) rechunk "${{ matrix.base_name }}" \
                            "${{ matrix.stream_name }}" \
                            "${{ matrix.image_flavor }}" \
                            "1"

      - name: Load Image into Podman
        id: load-rechunk
        shell: bash
        run: |
          sudo -E $(command -v just) load-rechunk "${{ matrix.base_name }}" \
                            "${{ env.DEFAULT_TAG }}" \
                            "${{ matrix.image_flavor }}"

      - name: Secureboot Check
        id: secureboot
        shell: bash
        run: |
          sudo -E $(command -v just) secureboot "${{ matrix.base_name }}" \
                          "${{ env.DEFAULT_TAG }}" \
                          "${{ matrix.image_flavor }}"

      - name: Generate tags
        id: generate-tags
        shell: bash
        run: |
          alias_tags="$(just generate-build-tags \
                     "${{ matrix.base_name }}" \
                     "${{ matrix.stream_name }}" \
                     "${{ matrix.image_flavor }}" \
                     "${{ inputs.kernel_pin }}" \
                     "1" \
                     "$(podman inspect ${{ env.IMAGE_NAME }}:${{ env.DEFAULT_TAG }} | jq -r '.[].Config.Labels["org.opencontainers.image.version"]')" \
                     "${{ github.event_name }}" \
                     "${{ github.event.number }}")"

          echo "Tags for this Action..."
          echo "$alias_tags"
          echo "alias_tags=${alias_tags}" >> $GITHUB_OUTPUT

      # Tag Images
      - name: Tag Images
        shell: bash
        run: |
          set -eoux pipefail
          sudo -E $(command -v just) tag-images "${{ env.IMAGE_NAME }}" \
                          "${{ env.DEFAULT_TAG }}" \
                          "${{ steps.generate-tags.outputs.alias_tags }}"

      # Workaround bug where capital letters in your GitHub username make it impossible to push to GHCR.
      # https://github.com/macbre/push-to-ghcr/issues/12
      - name: Lowercase Registry
        id: registry_case
        uses: ASzc/change-string-case-action@ecd1412d078f2e06e9eedcbaa6fcd988151c3f82 # v8
        with:
          string: ${{ env.IMAGE_REGISTRY }}

      - name: Login to GitHub Container Registry
        if: github.event_name != 'pull_request'
        run: |
          echo ${{ secrets.GITHUB_TOKEN }} | podman login ghcr.io -u ${{ github.actor }} --password-stdin
          echo ${{ secrets.GITHUB_TOKEN }} | docker login ghcr.io -u ${{ github.actor }} --password-stdin

      - name: Push to GHCR
        id: push
        if: github.event_name != 'pull_request'
        uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0
        with:
          max_attempts: 3
          retry_wait_seconds: 15
          timeout_minutes: 30
          command: |
            set -euox pipefail

            digest_file="$PWD/.push-digest"
            for tag in ${{ steps.generate-tags.outputs.alias_tags }}; do
              dest=${{ steps.registry_case.outputs.lowercase }}/${{ env.IMAGE_NAME }}:${tag}
              if [[ "${tag}" == "${{ env.DEFAULT_TAG }}" ]]; then
                sudo -E podman push --digestfile "${digest_file}" ${{ env.IMAGE_NAME }}:${tag} "${dest}"
              else
                sudo -E podman push ${{ env.IMAGE_NAME }}:${tag} "${dest}"
              fi
            done

            digest="$(cat "${digest_file}")"
            echo "digest=${digest}" >> $GITHUB_OUTPUT

      - name: Install Cosign
        uses: sigstore/cosign-installer@7e8b541eb2e61bf99390e1afd4be13a184e9ebc5 # v3.10.1
        if: github.event_name != 'pull_request'

      - name: Sign container image
        if: github.event_name != 'pull_request'
        run: |
          cosign sign -y --key env://COSIGN_PRIVATE_KEY ${{ steps.registry_case.outputs.lowercase }}/${{ env.IMAGE_NAME }}@${TAGS}
        env:
          TAGS: ${{ steps.push.outputs.digest }}
          COSIGN_EXPERIMENTAL: false
          COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}

      - name: Install ORAS
        if: github.event_name != 'pull_request'
        uses: oras-project/setup-oras@38de303aac69abb66f3e6255b7198bff35f323e3 # v2.0.0

      - name: Login to GitHub Container Registry with ORAS
        if: github.event_name != 'pull_request'
        run: |
          echo ${{ secrets.GITHUB_TOKEN }} | oras login ghcr.io -u ${{ github.actor }} --password-stdin

      - name: Upload SBOM
        if: github.event_name != 'pull_request'
        id: upload-sbom
        env:
          IMAGE: ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}
          DIGEST: ${{ steps.push.outputs.digest }}
          IMAGE_NAME: ${{ env.IMAGE_NAME }}
        run: |
          SBOM="sbom_out/${IMAGE_NAME}/sbom.json"

          cd "$(dirname "${SBOM}")"
          oras attach \
            --artifact-type application/vnd.spdx+json \
            --annotation filename=$(basename "$SBOM") \
            "${IMAGE}@${DIGEST}" \
            "$(basename ${SBOM})"

          sbom_digest=$(oras discover --format json "${IMAGE}@${DIGEST}" | jq -r '.referrers[] | select(.artifactType == "application/vnd.spdx+json") | .digest')

          echo "sbom_digest=${sbom_digest}" >> $GITHUB_OUTPUT

      - name: Sign SBOM OCI Artifact
        if: github.event_name != 'pull_request'
        env:
          COSIGN_EXPERIMENTAL: false
          COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
          LOWERCASE: ${{ steps.registry_case.outputs.lowercase }}
          IMAGE_NAME: ${{ env.IMAGE_NAME }}
          SBOM_DIGEST: ${{ steps.upload-sbom.outputs.sbom_digest }}
        run: |
          cosign sign -y --key env://COSIGN_PRIVATE_KEY ${LOWERCASE}/${IMAGE_NAME}@${SBOM_DIGEST}

      - name: Attestation
        if: github.event_name != 'pull_request'
        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 #v4.1.0
        with:
          subject-name: ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}
          subject-digest: ${{ steps.push.outputs.digest }}
          push-to-registry: true

  check:
    name: Check all ${{ matrix.stream_name }} builds successful
    if: always()
    runs-on: ubuntu-latest
    needs: [build_container]
    steps:
      - name: Check Jobs
        env:
          JOBS: ${{ toJson(needs) }}
        run: |
          echo "Job status:"
          echo $JOBS | jq -r 'to_entries[] | " - \(.key): \(.value.result)"'

          for i in $(echo $JOBS | jq -r 'to_entries[] | .value.result'); do
            if [ "$i" != "success" ] && [ "$i" != "skipped" ]; then
              echo ""
              echo "Status check not okay!"
              exit 1
            fi
          done