ci.yml

name: Build and push images

env:
  # Use docker.io for Docker Hub if empty
  REGISTRY: ghcr.io
  # github.repository as <account>/<repo>
  IMAGE_NAME: ${{ github.repository }}

on:
  push:
    branches:
      - master
      - renovate/*

jobs:
  build:
    name: ${{ matrix.config.arch }}
    runs-on: ubuntu-latest

    permissions:
      contents: read
      packages: write
      # This is used to complete the identity challenge
      # with sigstore/fulcio when running outside of PRs.
      id-token: write

    strategy:
      fail-fast: false
      matrix:
        config:
          - arch: x86_64
            platform: linux/amd64
          - arch: aarch64
            platform: linux/arm64
          - arch: riscv64
            platform: linux/riscv64

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Docker Metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: |
            ${{ env.IMAGE_NAME }}
          tags: |
            type=sha
            type=ref,event=branch
            type=ref,event=pr
            type=ref,event=tag
            type=schedule

      - name: Build image
        id: build-image
        uses: redhat-actions/buildah-build@v2
        with:
          platforms: ${{ matrix.config.platform }}
          image: ${{ env.IMAGE_NAME }}
          tags: ${{ github.sha }}-${{ matrix.config.arch }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: ARCH=${{ matrix.config.arch }}
          containerfiles: Containerfile

      - name: Push image
        id: push-image
        uses: redhat-actions/push-to-registry@v2
        with:
          image: ${{ steps.build-image.outputs.image }}
          tags: ${{ steps.build-image.outputs.tags }}
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

  push_manifest:
    needs: build
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/master'

    permissions:
      contents: read
      packages: write
      # This is used to complete the identity challenge
      # with sigstore/fulcio when running outside of PRs.
      id-token: write

    steps:
      - uses: actions/checkout@v4

      - name: Podman login
        uses: redhat-actions/podman-login@v1
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: create and push manifest for supported platforms
        run: |
          image_base_raw=${{ env.IMAGE_NAME }}
          image_base=${image_base_raw@L}
          image_base_sha=${image_base_raw@L}:${{ github.sha }}
          podman manifest create $image_base
          podman pull ${{ env.REGISTRY }}/$image_base_sha-x86_64
          podman pull ${{ env.REGISTRY }}/$image_base_sha-aarch64
          podman pull ${{ env.REGISTRY }}/$image_base_sha-riscv64
          podman manifest add $image_base ${{ env.REGISTRY }}/$image_base_sha-x86_64
          podman manifest add $image_base ${{ env.REGISTRY }}/$image_base_sha-aarch64
          podman manifest add $image_base ${{ env.REGISTRY }}/$image_base_sha-riscv64
          podman manifest push $image_base ${{ env.REGISTRY }}/$image_base_sha
          podman manifest push $image_base ${{ env.REGISTRY }}/$image_base:${{ github.ref_name }}