build.yml

name: Build cso Image
# yamllint disable rule:line-length
on: # yamllint disable-line rule:truthy
  push:
    branches:
      - main
      - addons
  # If the cache was cleaned we should re-build the cache with the latest commit
  workflow_run:
    workflows:
      - "CSO Image Cache Cleaner"
    branches:
      - main
    types:
      - completed
  workflow_dispatch:
env:
  REGISTRY: ghcr.io/sovereigncloudstack
  metadata_flavor: latest=true
  metadata_tags: type=sha,prefix=sha-,format=short
permissions:
  contents: read
  packages: write
  # Required to generate OIDC tokens for `sigstore/cosign-installer` authentication
  id-token: write
jobs:
  manager-image:
    name: Build and push manager image
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3
        with:
          fetch-depth: 0
      - uses: ./.github/actions/setup-go
      - name: Set up QEMU
        uses: docker/setup-qemu-action@2b82ce82d56a2a04d2637cd93a637ae1b359c0a7 # v2
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@ecf95283f03858871ff00b787d79c419715afc34 # v2

      - name: Generate metadata cso
        id: metacso
        uses: ./.github/actions/metadata
        env:
          IMAGE_NAME: cso-staging
        with:
          metadata_flavor: ${{ env.metadata_flavor }}
          metadata_tags: ${{ env.metadata_tags }}

      - name: Login to ghcr.io for CI
        uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2.2.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Install Cosign
        uses: sigstore/cosign-installer@dd6b2e2b610a11fd73dd187a43d57cc1394e35f9 # v3.0.5

      - name: Setup Env
        run: |
          DOCKER_BUILD_LDFLAGS="$(hack/version.sh)"
          echo 'DOCKER_BUILD_LDFLAGS<<EOF' >> $GITHUB_ENV
          echo $DOCKER_BUILD_LDFLAGS >> $GITHUB_ENV
          echo 'EOF' >> $GITHUB_ENV

      # Load Golang cache build from GitHub
      - name: Load cso Golang cache build from GitHub
        uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
        id: cache
        with:
          path: /tmp/.cache/cso
          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}-cso-${{ github.sha }}
          restore-keys: |
            ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}-cso-
            ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}-
            ${{ runner.os }}-go-

      - name: Create cso cache directory
        if: ${{ steps.cache.outputs.cache-hit != 'true' }}
        shell: bash
        run: |
          mkdir -p /tmp/.cache/cso

      # Import GitHub's cache build to docker cache
      - name: Copy cso Golang cache to docker cache
        uses: docker/build-push-action@2eb1c1961a95fc15694676618e422e8ba1d63825 # v4.1.1
        with:
          provenance: false
          context: /tmp/.cache/cso
          file: ./images/cache/Dockerfile
          push: false
          platforms: linux/amd64
          target: import-cache

      - name: Build and push cso image
        uses: docker/build-push-action@2eb1c1961a95fc15694676618e422e8ba1d63825 # v4
        id: docker_build_release_cso
        with:
          provenance: false
          context: .
          file: ./images/cso/Dockerfile
          push: true
          build-args: |
            LDFLAGS=${{ env.DOCKER_BUILD_LDFLAGS }}
          tags: ${{ steps.metacso.outputs.tags }}
          labels: ${{ steps.metacso.outputs.labels }}
          platforms: linux/amd64

      - name: Sign Container Images
        env:
          COSIGN_EXPERIMENTAL: "true"
        run: |
          cosign sign --yes ghcr.io/sovereigncloudstack/cso-staging@${{ steps.docker_build_release_cso.outputs.digest }}

      - name: Image Releases digests cso
        shell: bash
        run: |
          mkdir -p image-digest/
          echo "ghcr.io/sovereigncloudstack/cso-staging:{{ steps.metacso.outputs.tags }}@${{ steps.docker_build_release_cso.outputs.digest }}" >> image-digest/cso.txt

      # Upload artifact digests
      - name: Upload artifact digests
        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
        with:
          name: image-digest
          path: image-digest
          retention-days: 90

      # Store docker's golang's cache build locally only on the main branch
      - name: Store cso Golang cache build locally
        if: ${{ steps.cache.outputs.cache-hit != 'true' }}
        uses: docker/build-push-action@2eb1c1961a95fc15694676618e422e8ba1d63825 # v4.1.1
        with:
          provenance: false
          context: .
          file: ./images/cache/Dockerfile
          push: false
          outputs: type=local,dest=/tmp/docker-cache-cso
          platforms: linux/amd64
          target: export-cache

      # Store docker's golang's cache build locally only on the main branch
      - name: Store cso Golang cache in GitHub cache path
        if: ${{ steps.cache.outputs.cache-hit != 'true' }}
        shell: bash
        run: |
          mkdir -p /tmp/.cache/cso/
          if [ -f /tmp/docker-cache-cso/tmp/go-build-cache.tar.gz ]; then
          cp /tmp/docker-cache-cso/tmp/go-build-cache.tar.gz /tmp/.cache/cso/
          fi
          if [ -f /tmp/docker-cache-cso/tmp/go-pkg-cache.tar.gz ]; then
          cp /tmp/docker-cache-cso/tmp/go-pkg-cache.tar.gz /tmp/.cache/cso/
          fi

      - name: Image Digests Output
        shell: bash
        run: |
          cd image-digest/
          find -type f | sort | xargs -d '\n' cat