docker.yaml

name: Docker

permissions:
  contents: read

on:
  release:
    types:
      - published
  push:
    branches:
      - main
    tags:
      - v*
    paths-ignore:
      - "docs/**"
      - "**/*.md"
  pull_request:
    paths-ignore:
      - "docs/**"
      - "**/*.md"
    types: [labeled, unlabeled, opened, synchronize, reopened]

jobs:
  buildAndPush:
    strategy:
      matrix:
        image:
          - name: arc-controller-manager
            context: .
            target: manager
          - name: arc-apiserver
            context: .
            target: apiserver
          - name: ocm-tools
            context: examples/ocm
            target: ""
            ocmVersion: "0.46.0"
    permissions:
      actions: read
      contents: read
      packages: write # Push to ghcr.io
      id-token: write # Needed to create an OIDC token for keyless signing
      attestations: write # Write attestations to GitHub API as well
    name: Build and Publish Docker Image
    # Condition: Run on push to main, published release, PR with 'ok-to-image' label, or any workflow_call (caller already decided)
    if: |
      github.event_name == 'push' ||
      (github.event_name == 'pull_request' && (
        contains(toJSON(github.event.pull_request.labels), '"ok-to-image"') ||
        contains(toJSON(github.event.pull_request.labels), '"ok-to-e2e"')
      )) ||
      (github.event_name == 'release' && github.event.action == 'published')
    runs-on: ubuntu-24.04
    outputs:
      image-tag: ${{ steps.meta.outputs.version }}
      is-local: ${{ env.ACT == 'true' }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false
      - name: Setup Local Registry for act
        if: ${{ env.ACT == 'true' }}
        run: |
          if ! docker ps | grep -q act-registry; then
            docker run -d -p 5001:5000 --name act-registry registry:2
          fi
      - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
        id: meta
        with:
          images: |
            ${{ env.ACT == 'true' && 'localhost:5001/local' || format('ghcr.io/{0}', github.repository_owner) }}/${{ matrix.image.name }}
          tags: |
            type=semver,pattern={{version}}
            type=schedule
            type=ref,event=branch
            type=ref,event=tag
            type=ref,event=pr
            type=sha
            ${{ matrix.image.name == 'ocm-tools' && github.ref == 'refs/heads/main' && format('type=raw,value={0}', matrix.image.ocmVersion) || '' }}
          flavor: |
            latest=${{ matrix.image.name != 'ocm-tools' && github.ref == 'refs/heads/main' }}
      - name: Set up QEMU
        if: ${{ env.ACT != 'true' }}
        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4
        with:
          platforms: arm64
      - name: Set up Docker Buildx
        timeout-minutes: 5
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
        with:
          version: latest
          driver-opts: ${{ env.ACT == 'true' && 'network=host' || '' }}
      - name: Login to GHCR
        if: ${{ env.ACT != 'true' }}
        uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c # v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Build and push
        id: image
        timeout-minutes: 20
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
        with:
          context: ${{ matrix.image.context }}
          platforms: ${{ env.ACT == 'true' && 'linux/amd64' || 'linux/amd64,linux/arm64' }}
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          target: ${{ matrix.image.target }}
          build-args: ${{ matrix.image.name == 'ocm-tools' && format('OCM_VERSION={0}', matrix.image.ocmVersion) || '' }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
      - name: Install cosign
        if: ${{ env.ACT != 'true' }}
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
      - name: Sign image with cosign
        if: ${{ env.ACT != 'true' }}
        env:
          COSIGN_EXPERIMENTAL: 1
        run: |
          IFS=',' read -ra TAGS <<< "${{ steps.meta.outputs.tags }}"
          for tag in "${TAGS[@]}"; do
            cosign sign \
              -a "repo=${{ github.repository }}" \
              -a "workflow=${{ github.workflow }}" \
              -a "sha=${{ github.sha }}" \
              --yes \
              "$tag"@${{ steps.image.outputs.digest }}
          done
      - name: Extract first tag
        id: first-tag
        run: |
          IFS=$'\n' read -ra TAGS <<< "${{ steps.meta.outputs.tags }}"
          echo "tag=${TAGS[0]}" >> $GITHUB_OUTPUT
      - name: Generate SBOM
        if: ${{ env.ACT != 'true' }}
        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0
        with:
          image: ${{ steps.first-tag.outputs.tag }}
          format: 'cyclonedx-json'
          output-file: 'sbom.cyclonedx.json'
          upload-release-assets: false # we use immutable releases
      - name: Attest SBOM
        if: ${{ env.ACT != 'true' }}
        uses: actions/attest-sbom@c604332985a26aa8cf1bdc465b92731239ec6b9e # v4
        with:
          subject-name: ghcr.io/${{ github.repository_owner }}/${{ matrix.image.name }}
          subject-digest: ${{ steps.image.outputs.digest }}
          sbom-path: 'sbom.cyclonedx.json'
          push-to-registry: true
      - name: Attest provenance
        if: ${{ env.ACT != 'true' }}
        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4
        with:
          subject-name: ghcr.io/${{ github.repository_owner }}/${{ matrix.image.name }}
          subject-digest: ${{ steps.image.outputs.digest }}
          push-to-registry: true

  test-e2e:
    needs: buildAndPush
    if: needs.buildAndPush.result == 'success'
    uses: ./.github/workflows/test-e2e.yaml
    with:
      image-tag: ${{ needs.buildAndPush.outputs.image-tag }}
      is-local: ${{ fromJson(needs.buildAndPush.outputs.is-local) }}
    permissions:
      contents: read
      packages: read