trustmee/.github/workflows/build-kbs-client-image.yml at main · elasticproject-eu/trustmee · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
name: Build KBS Client Image

on:
  workflow_call:
    inputs:
      build_option:
        description: 'Build option for the image'
        type: string
        required: false
    secrets:
      GHCR_TOKEN:
        description: 'GitHub token for GHCR'
        required: true

permissions:
  contents: read

jobs:
  build_kbs_client_image:
    permissions:
      packages: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - arch: x86_64
            instance: ubuntu-24.04
          - arch: s390x
            instance: s390x
          - arch: aarch64
            instance: ubuntu-24.04-arm
    runs-on: ${{ matrix.instance }}

    steps:
    - name: Checkout code
      uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
      with:
        persist-credentials: false

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1

    - name: Login to GHCR Container Registry
      uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
      with:
        registry: ghcr.io
        username: ${{ github.actor }}
        password: ${{ secrets.GHCR_TOKEN }}

    - name: Build Container Image KBS-Client (${{ matrix.arch }})
      run: |
        commit_sha=${{ github.sha }}
        docker buildx build --provenance false \
          ${INPUTS_BUILD_OPTION:+"$INPUTS_BUILD_OPTION"} \
          -f kbs/docker/kbs-client-image/Dockerfile \
          -t "ghcr.io/confidential-containers/staged-images/kbs-client-image:${commit_sha}-${{ matrix.arch }}" \
          -t "ghcr.io/confidential-containers/staged-images/kbs-client-image:latest-${{ matrix.arch }}" .
      env:
        INPUTS_BUILD_OPTION: ${{ inputs.build_option }}