build.yml

---
# ba0fde3d-bee7-4307-b97b-17d0d20aff50
name: Build image
on:
  pull_request:
  push:
    branches:
      - 'main'
    paths-ignore:
      - '**/README.md'
  workflow_dispatch:

  schedule:
    # run on Saturday at 10:00 UTC
    - cron: '0 10 * * 6'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
  cancel-in-progress: true

jobs:
  set-env:
    runs-on: ubuntu-latest
    outputs:
      LATEST_TAG: ${{ steps.set.outputs.LATEST_TAG }}
      REGISTRY: ${{ steps.set.outputs.REGISTRY }}
      REGISTRY_USER: ${{ steps.set.outputs.REGISTRY_USER }}
      PLATFORMS: ${{ steps.set.outputs.PLATFORMS }}
      IMAGE_PATH: ${{ steps.set.outputs.IMAGE_PATH }}
      IMAGE_NAME: ${{ steps.set.outputs.IMAGE_NAME }}
      IMAGE_REF: ${{ steps.set.outputs.IMAGE_REF }}
      VARIANTS: ${{ steps.set.outputs.VARIANTS }}
      MATRIX: ${{ steps.set.outputs.MATRIX }}
      IS_SIGNED: ${{ steps.set.outputs.IS_SIGNED }}
    steps:
      - name: Checkout github actions
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4

      - name: Set environment variables
        uses: ./.github/actions/config
        id: set
        with:
          VARIANT: "ALL"

  build-test-promote:
    name: Build, Test, Promote
    needs: set-env
    strategy:
      fail-fast: false
      matrix: ${{fromJson(needs.set-env.outputs.MATRIX)}}
    uses: ./.github/workflows/reusable-build.yml
    with:
      variant: ${{ matrix.variant }}
      containerfile: Dockerfile
      image_name: "${{ needs.set-env.outputs.IMAGE_NAME }}-${{ matrix.variant }}"
      previous_image: "${{ needs.set-env.outputs.IMAGE_REF }}-${{ matrix.variant }}:latest"
      update_origin_ref: "${{ needs.set-env.outputs.IMAGE_REF }}-${{ matrix.variant }}:${{ needs.set-env.outputs.LATEST_TAG }}"
      latest_tag: ${{ needs.set-env.outputs.LATEST_TAG }}
      update_is_signed: ${{ needs.set-env.outputs.IS_SIGNED == 'true' }}
      config_file: ./iso.toml
      platforms: ${{ needs.set-env.outputs.PLATFORMS }}
      image_path: ${{ needs.set-env.outputs.IMAGE_PATH }}
      registry: ${{ needs.set-env.outputs.REGISTRY }}
      registry_user: ${{ needs.set-env.outputs.REGISTRY_USER }}
      KMS_KEY_ALIAS: atomicsig
      AWS_REGION: us-east-1
    secrets:
      REGISTRY_TOKEN: ${{ secrets.QUAY_PASSWORD }}
      AWS_ROLE_ARN: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/atomicimages
    permissions:
      contents: read
      packages: write
      id-token: write

  create-release:
    name: Create Release
    needs: [set-env, build-test-promote]
    if: ${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
    runs-on: ubuntu-latest

    steps:
      - name: Fetch Changelogs
        id: download-changelogs
        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v4
        with:
          pattern: changelog-*
          merge-multiple: true
          path: /tmp/changelogs

      - name: Fetch SBOMs
        id: download-sbom
        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v4
        with:
          pattern: "*.spdx.json"
          merge-multiple: true
          path: /tmp/sboms

      - name: Compress SBOMs
        id: compress-sbom
        shell: bash
        run: |
          cd ${{ steps.download-sbom.outputs.download-path }}
          for f in *.spdx.json; do
            gzip -9 "$f"
          done

      - name: Prepare Release
        id: prepare-release
        shell: bash
        run: |
          if [[ ! -d ${{ steps.download-changelogs.outputs.download-path }} ]]; then
            echo "No changelogs found, skipping release creation"
            echo "skip=1" >> "$GITHUB_ENV"
            exit
          fi

          echo "Automated release for version \`${{ needs.build-test-promote.outputs.version }}\`." > ./changelog.md

          for changelog in ${{ steps.download-changelogs.outputs.download-path }}/*.txt; do
            # Remove empty Package Changes
            sed -i '/^#### Package Changes$/{
            N
            N
            /#### Package Changes\n[[:space:]]*-[[:space:]]*\n[[:space:]]*$/d
            }' $changelog

            # Remove empty Commits
            sed -i '/^#### Commits$/{
            N
            N
            /#### Commits\n[[:space:]]*-[[:space:]]*\n[[:space:]]*$/d
            }' $changelog

            # If there are no changes, remove the section altogether
            sed -zi 's/\n### Changes since[^#]*$//' $changelog

            cat $changelog >> ./changelog.md
          done

      - name: Create Release
        if: ${{ env.skip != '1' }}
        uses: softprops/action-gh-release@aec2ec56f94eb8180ceec724245f64ef008b89f5 # v2
        with:
          name: "Version ${{ needs.build-test-promote.outputs.version }}"
          tag_name: ${{ needs.build-test-promote.outputs.version }}
          body_path: ./changelog.md
          make_latest: true
          files: "${{ steps.download-sbom.outputs.download-path }}/*.spdx.json.gz"