reusable-build.yml

name: Reusable Build and Push
on:
  workflow_call:
    inputs:
      image_flavors:
        description: "JSON string of flavors to build, '[main, nvidia-open]'"
        default: "['main','nvidia-open']"
        type: string
      brand_name:
        description: "The Brand Name: aurora"
        required: true
        default: aurora
        type: string
      stream_name:
        description: "The Fedora Version: stable, or latest"
        required: true
        type: string
      kernel_pin:
        description: "The full kernel version to pin"
        type: string

env:
  IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }}

concurrency:
  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}-${{ inputs.brand_name}}-${{ inputs.stream_name }}
  cancel-in-progress: true

jobs:
  build_container:
    name: image
    runs-on: ubuntu-24.04
    continue-on-error: false
    strategy:
      fail-fast: false
      matrix:
        image_flavor: ${{ fromJson(inputs.image_flavors) }}
        base_name: ["${{ inputs.brand_name }}", "${{ inputs.brand_name }}-dx"]
        stream_name: ["${{ inputs.stream_name }}"]

    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      # mount /mnt as /var/lib/containers
      - name: Mount BTRFS for podman storage
        id: container-storage-action
        uses: ublue-os/container-storage-action@dc1f4c8f17b672069e921f001132f7cf98a423a6
        continue-on-error: true
        with:
          target-dir: /var/lib/containers
          mount-opts: compress-force=zstd:2
          loopback-free: '1'

      - name: Setup Just
        uses: extractions/setup-just@e33e0265a09d6d736e2ee1e0eb685ef1de4669ff # v3

      - name: Check Just Syntax
        shell: bash
        run: |
          just check

      - name: Image Name
        shell: bash
        env:
          MATRIX_BASE_NAME: ${{ matrix.base_name }}
          MATRIX_STREAM_NAME: ${{ matrix.stream_name }}
          MATRIX_IMAGE_FLAVOR: ${{ matrix.image_flavor }}
        run: |
          IMAGE_NAME="$(just image_name ${MATRIX_BASE_NAME} ${MATRIX_STREAM_NAME} ${MATRIX_IMAGE_FLAVOR})"
          echo "IMAGE_NAME=${IMAGE_NAME}" >> $GITHUB_ENV

      - name: Default Tag
        shell: bash
        env:
          MATRIX_STREAM_NAME: ${{ matrix.stream_name }}
        run: |
          DEFAULT_TAG="$(just generate-default-tag \
                       "${MATRIX_STREAM_NAME}" \
                       "1")"
          echo "Default Tag: ${DEFAULT_TAG}"
          echo "DEFAULT_TAG=${DEFAULT_TAG}" >> $GITHUB_ENV

      - name: Build Image
        id: build-image
        shell: bash
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          MATRIX_BASE_NAME: ${{ matrix.base_name }}
          MATRIX_STREAM_NAME: ${{ matrix.stream_name }}
          MATRIX_IMAGE_FLAVOR: ${{ matrix.image_flavor }}
          INPUTS_KERNEL_PIN: ${{ inputs.kernel_pin }}
        run: |
          sudo -E $(command -v just) repo_organization="${{ github.repository_owner }}" \
                    build-ghcr "${MATRIX_BASE_NAME}" \
                               "${MATRIX_STREAM_NAME}" \
                               "${MATRIX_IMAGE_FLAVOR}" \
                               "${INPUTS_KERNEL_PIN}"

      - name: Setup Syft
        id: setup-syft
        if: github.event_name != 'pull_request'
        uses: anchore/sbom-action/download-syft@28d71544de8eaf1b958d335707167c5f783590ad # v0
        with:
          syft-version: v1.39.0

      - name: Generate SBOM
        if: github.event_name != 'pull_request'
        id: generate-sbom
        env:
          IMAGE: ${{ env.IMAGE_NAME }}
          STREAM_NAME: ${{ matrix.stream_name }}
          SYFT_CMD: ${{ steps.setup-syft.outputs.cmd }}
          OCI_DIR: "/tmp/image-oci-dir"
        run: |
          mkdir -p ${OCI_DIR}/rootfs
          sudo podman container create --replace --name aurora-tmp "localhost/${IMAGE}:${STREAM_NAME}"
          sudo podman export aurora-tmp | sudo tar -C ${OCI_DIR}/rootfs -xf -
          sudo podman container rm aurora-tmp

          OUTPUT_PATH="$(mktemp -d)/sbom.json"
          export SYFT_PARALLELISM=$(($(nproc)*2))
          sudo $SYFT_CMD --source-name "${IMAGE}"-"${STREAM_NAME}" ${OCI_DIR} -o syft-json=${OUTPUT_PATH}
          du -sh ${OUTPUT_PATH}
          echo "OUTPUT_PATH=${OUTPUT_PATH}" >> $GITHUB_OUTPUT
          sudo rm -rf ${OCI_DIR}

      - name: debug
        run: sudo podman images

      - name: Rechunk Image with rpm-ostree
        id: rechunker
        env:
          MATRIX_BASE_NAME: ${{ matrix.base_name }}
          DEFAULT_TAG: ${{ env.DEFAULT_TAG }}
          MATRIX_IMAGE_FLAVOR: ${{ matrix.image_flavor }}
        run: |
          sudo -E $(command -v just) rechunk "${MATRIX_BASE_NAME}" \
                            "${DEFAULT_TAG}" \
                            "${MATRIX_IMAGE_FLAVOR}"

      - name: debug
        run: sudo podman images

      - name: Secureboot Check
        id: secureboot
        shell: bash
        env:
          MATRIX_BASE_NAME: ${{ matrix.base_name }}
          DEFAULT_TAG: ${{ env.DEFAULT_TAG }}
          MATRIX_IMAGE_FLAVOR: ${{ matrix.image_flavor }}
        run: |
          sudo -E $(command -v just) secureboot "${MATRIX_BASE_NAME}" \
                            "${DEFAULT_TAG}" \
                            "${MATRIX_IMAGE_FLAVOR}"

      - name: Generate tags
        id: generate-tags
        shell: bash
        env:
          MATRIX_BASE_NAME: "${{ matrix.base_name }}"
          MATRIX_STREAM_NAME: "${{ matrix.stream_name }}"
          MATRIX_IMAGE_FLAVOR: "${{ matrix.image_flavor }}"
          INPUTS_KERNEL_PIN: "${{ inputs.kernel_pin }}"
          IMAGE_NAME: ${{ env.IMAGE_NAME }}
          DEFAULT_TAG: ${{ env.DEFAULT_TAG }}
          GITHUB_EVENT_NAME: ${{ github.event_name }}
          GITHUB_EVENT_NUMBER: ${{ github.event.number }}
        run: |
          alias_tags="$(just generate-build-tags \
                     "${MATRIX_BASE_NAME}" \
                     "${MATRIX_STREAM_NAME}" \
                     "${MATRIX_IMAGE_FLAVOR}" \
                     "${INPUTS_KERNEL_PIN}" \
                     "1" \
                     "$(podman inspect ${IMAGE_NAME}:${DEFAULT_TAG} | jq -r '.[].Config.Labels["org.opencontainers.image.version"]')" \
                     "${GITHUB_EVENT_NAME}" \
                     "${GITHUB_EVENT_NUMBER}")"

          echo "Tags for this Action..."
          echo "$alias_tags"
          echo "alias_tags=${alias_tags}" >> $GITHUB_OUTPUT

      # Tag Images
      - name: Tag Images
        shell: bash
        env:
          IMAGE_NAME: ${{ env.IMAGE_NAME }}
          DEFAULT_TAG: ${{ env.DEFAULT_TAG }}
          ALIAS_TAGS: ${{ steps.generate-tags.outputs.alias_tags }}
        run: |
          set -eoux pipefail
          sudo -E $(command -v just) tag-images "${IMAGE_NAME}" \
                          "${DEFAULT_TAG}" \
                          "${ALIAS_TAGS}"

      # Workaround bug where capital letters in your GitHub username make it impossible to push to GHCR.
      # https://github.com/macbre/push-to-ghcr/issues/12
      - name: Lowercase Registry
        id: registry_case
        uses: ASzc/change-string-case-action@d0603cd0a7dd490be678164909f65c7737470a7f # v6
        with:
          string: ${{ env.IMAGE_REGISTRY }}

      # TODO: remove me when we have a new podman in 26.04 runners
      # needed because old podman doesn't push layer annotations for
      # the rpm-ostree rechunker at all
      - name: install podman from brew
        if: github.event_name != 'pull_request'
        run: |
          /home/linuxbrew/.linuxbrew/bin/brew install podman

      - name: Login to GitHub Container Registry
        if: github.event_name != 'pull_request'
        run: |
          echo ${{ secrets.GITHUB_TOKEN }} | podman login ghcr.io -u ${{ github.actor }} --password-stdin
          echo ${{ secrets.GITHUB_TOKEN }} | docker login ghcr.io -u ${{ github.actor }} --password-stdin

      - name: Push to GHCR
        id: push
        if: github.event_name != 'pull_request'
        uses: Wandalen/wretry.action@e68c23e6309f2871ca8ae4763e7629b9c258e1ea # v3.8.0
        env:
          ALIAS_TAGS: ${{ steps.generate-tags.outputs.alias_tags }}
          IMAGE_NAME: ${{ env.IMAGE_NAME }}
          LOWERCASE: ${{ steps.registry_case.outputs.lowercase }}
          DEFAULT_TAG: ${{ env.DEFAULT_TAG }}
        with:
          attempt_limit: 3
          attempt_delay: 15000
          command: |
            set -euox pipefail
            # HACK: push a second time so layer annotations are pushed
            # TODO: remove me when https://github.com/containers/podman/issues/27796 fixed

            for tag in ${ALIAS_TAGS}; do
              sudo -E /home/linuxbrew/.linuxbrew/bin/podman push ${IMAGE_NAME}:${tag} ${LOWERCASE}/${IMAGE_NAME}:${tag}
            done

            for tag in ${ALIAS_TAGS}; do
              sudo -E /home/linuxbrew/.linuxbrew/bin/podman push ${IMAGE_NAME}:${tag} ${LOWERCASE}/${IMAGE_NAME}:${tag}
            done

            digest=$(skopeo inspect docker://${LOWERCASE}/${IMAGE_NAME}:${DEFAULT_TAG} --format '{{.Digest}}')

            echo "digest=${digest}" >> $GITHUB_OUTPUT

      - name: Install Cosign
        uses: sigstore/cosign-installer@7e8b541eb2e61bf99390e1afd4be13a184e9ebc5 # v3.10.1
        if: github.event_name != 'pull_request'

      - name: Sign container image
        if: github.event_name != 'pull_request'
        run: |
          cosign sign -y --key env://COSIGN_PRIVATE_KEY ${LOWERCASE}/${IMAGE_NAME}@${TAGS}
        env:
          TAGS: ${{ steps.push.outputs.outputs && fromJSON(steps.push.outputs.outputs).digest }}
          COSIGN_EXPERIMENTAL: false
          COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
          LOWERCASE: ${{ steps.registry_case.outputs.lowercase }}
          IMAGE_NAME: ${{ env.IMAGE_NAME }}

      - name: Add SBOM Attestation
        if: github.event_name != 'pull_request'
        env:
          IMAGE: ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}
          DIGEST: ${{ steps.push.outputs.outputs && fromJSON(steps.push.outputs.outputs).digest }}
          COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
          SBOM_OUTPUT: ${{ steps.generate-sbom.outputs.OUTPUT_PATH }}
        run: |
          cd "$(dirname "$SBOM_OUTPUT")"
          cosign attest -y \
            --predicate ./sbom.json \
            --type spdxjson \
            --key env://COSIGN_PRIVATE_KEY \
            "${IMAGE}@${DIGEST}"

  check:
    name: Check all ${{ matrix.stream_name }} builds successful
    if: always()
    runs-on: ubuntu-latest
    needs: [build_container]
    steps:
      - name: Check Jobs
        env:
          JOBS: ${{ toJson(needs) }}
        run: |
          echo "Job status:"
          echo $JOBS | jq -r 'to_entries[] | " - \(.key): \(.value.result)"'

          for i in $(echo $JOBS | jq -r 'to_entries[] | .value.result'); do
            if [ "$i" != "success" ] && [ "$i" != "skipped" ]; then
              echo ""
              echo "Status check not okay!"
              exit 1
            fi
          done