containers.yml

name: containersbuild
on:
    pull_request:
    schedule:
        - cron: "0 16 * * *" # builds an hour before images start automatically building
    push:
        paths:
            - ".github/**"
            - "config/scripts/build-scripts/**"
            - "containerfiles/**"
    workflow_dispatch:
env:
    IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }}

jobs:
    push-ghcr:
        name: Build and push containers
        runs-on: ubuntu-latest
        permissions:
            contents: read
            packages: write
            id-token: write
        strategy:
            fail-fast: false
            matrix:
                containerfile:
                    - containerfiles/wuzetka-helper/Containerfile
                    - containerfiles/mazurek-helper/Containerfile

        steps:
            # Checkout push-to-registry action GitHub repository
            - name: Checkout Push to Registry action
              uses: actions/checkout@v3

            - name: Gather environment variables
              run: echo "IMAGE_NAME=$(echo ${{ matrix.containerfile }} | cut -d . -f 1 | cut -d '/' -f 2)" >> $GITHUB_ENV

            # Build metadata
            - name: Image Metadata
              uses: docker/metadata-action@v4
              id: meta
              with:
                  images: |
                      ${{ env.IMAGE_NAME }}
                  labels: |
                      org.opencontainers.image.title=${{ env.IMAGE_NAME }}
                      org.opencontainers.image.description=${{ env.IMAGE_NAME }} is a container that helps another image being built for Sernik.

            - name: Generate tags
              id: generate-tags
              shell: bash
              run: |
                  # Generate a timestamp for creating an image version history
                  TIMESTAMP="$(date +%Y%m%d)"
                  COMMIT_TAGS=()
                  BUILD_TAGS=()
                  # Have tags for tracking builds during pull request
                  SHA_SHORT="${GITHUB_SHA::7}"
                  COMMIT_TAGS+=("pr-${{ github.event.number }}")
                  COMMIT_TAGS+=("${SHA_SHORT}")

                  BUILD_TAGS+=("${TIMESTAMP}")
                  BUILD_TAGS+=("latest")

                  if [[ "${{ github.event_name }}" == "pull_request" ]]; then
                      echo "Generated the following commit tags: "
                      for TAG in "${COMMIT_TAGS[@]}"; do
                          echo "${TAG}"
                      done
                      alias_tags=("${COMMIT_TAGS[@]}")
                  else
                      alias_tags=("${BUILD_TAGS[@]}")
                  fi
                  echo "Generated the following build tags: "
                  for TAG in "${BUILD_TAGS[@]}"; do
                      echo "${TAG}"
                  done
                  echo "alias_tags=${alias_tags[*]}" >> $GITHUB_OUTPUT

            # Build image using Buildah action
            - name: Build Image
              id: build_image
              uses: redhat-actions/buildah-build@v2
              with:
                  containerfiles: "${{ matrix.containerfile }}"
                  image: ${{ env.IMAGE_NAME }}
                  tags: |
                      ${{ steps.generate-tags.outputs.alias_tags }}
                  labels: ${{ steps.meta.outputs.labels }}
                  oci: false

            # Workaround bug where capital letters in your GitHub username make it impossible to push to GHCR.
            # https://github.com/macbre/push-to-ghcr/issues/12
            - name: Lowercase Registry
              id: registry_case
              uses: ASzc/change-string-case-action@v5
              with:
                  string: ${{ env.IMAGE_REGISTRY }}

            # Push the image to GHCR (Image Registry)
            - name: Push To GHCR
              uses: redhat-actions/push-to-registry@v2
              id: push
              if: github.event_name != 'pull_request'
              env:
                  REGISTRY_USER: ${{ github.actor }}
                  REGISTRY_PASSWORD: ${{ github.token }}
              with:
                  image: ${{ steps.build_image.outputs.image }}
                  tags: ${{ steps.build_image.outputs.tags }}
                  registry: ${{ steps.registry_case.outputs.lowercase }}
                  username: ${{ env.REGISTRY_USER }}
                  password: ${{ env.REGISTRY_PASSWORD }}
                  extra-args: |
                      --disable-content-trust

            - name: Login to GitHub Container Registry
              uses: docker/login-action@v2
              if: github.event_name != 'pull_request'
              with:
                  registry: ghcr.io
                  username: ${{ github.actor }}
                  password: ${{ secrets.GITHUB_TOKEN }}

            # Sign container
            - uses: sigstore/cosign-installer@v3.4.0
              if: github.event_name != 'pull_request'

            - name: Sign container image
              if: github.event_name != 'pull_request'
              run: |
                  cosign sign -y --key env://COSIGN_PRIVATE_KEY ${{ steps.registry_case.outputs.lowercase }}/${{ env.IMAGE_NAME }}@${TAGS}
              env:
                  TAGS: ${{ steps.push.outputs.digest }}
                  COSIGN_EXPERIMENTAL: false
                  COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}

            - name: Echo outputs
              if: github.event_name != 'pull_request'
              run: |
                  echo "${{ toJSON(steps.push.outputs) }}"