call-build-images.yaml

---
name: Reusable workflow to build container images

on:
  workflow_call:
    inputs:
      version:
        description: The version of Fluent Bit to create.
        type: string
        required: true
      ref:
        description: The commit, tag or branch of Fluent Bit to checkout for building that creates the version above.
        type: string
        required: true
      registry:
        description: The registry to push container images to.
        type: string
        required: false
        default: ghcr.io
      username:
        description: The username for the registry.
        type: string
        required: true
      image:
        description: The name of the container image to push to the registry.
        type: string
        required: true
      environment:
        description: The Github environment to run this workflow on.
        type: string
        required: false
      unstable:
        description: Optionally add metadata to build to indicate an unstable build, set to the contents you want to add.
        type: string
        required: false
        default: ""
    secrets:
      token:
        description: The Github token or similar to authenticate with for the registry.
        required: true
      cosign_private_key:
        description: The optional Cosign key to use for signing the images.
        required: false
      cosign_private_key_password:
        description: If the Cosign key requires a password then specify here, otherwise not required.
        required: false
jobs:
  call-build-images-meta:
    name: Extract any supporting metadata
    outputs:
      major-version: ${{ steps.determine-major-version.outputs.replaced }}
    runs-on: ubuntu-latest
    environment: ${{ inputs.environment }}
    permissions:
      contents: read
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.ref }}

      # For main branch/releases we want to tag with the major version.
      # E.g. if we build version 1.9.2 we want to tag with 1.9.2 and 1.9.
      - name: Determine major version tag
        id: determine-major-version
        uses: frabert/replace-string-action@v2.5
        with:
          pattern: '^(\d+\.\d+).*$'
          string: ${{ inputs.version }}
          replace-with: "$1"
          flags: "g"

  # Taken from https://docs.docker.com/build/ci/github-actions/multi-platform/#distribute-build-across-multiple-runners
  # We split this out to make it easier to restart just one of them if it fails and do all in parallel
  call-build-single-arch-container-images:
    # Allow us to continue to create a manifest if we want
    continue-on-error: true
    permissions:
      contents: read
      packages: write
    strategy:
      fail-fast: false
      matrix:
        platform:
          - amd64
          - arm64
          - arm/v7
        target:
          - production
          - debug
    name: ${{ matrix.platform }}/${{ matrix.target }} container image build
    # Use GitHub Actions ARM hosted runners
    runs-on: ${{ (contains(matrix.platform, 'arm') && 'ubuntu-22.04-arm') || 'ubuntu-latest' }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.ref }}
          token: ${{ secrets.token }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to the Container registry
        uses: docker/login-action@v3
        with:
          registry: ${{ inputs.registry }}
          username: ${{ github.actor }}
          password: ${{ secrets.token }}

      - name: Build and push by digest the standard ${{ matrix.target }} image
        id: build
        uses: docker/build-push-action@v6
        with:
          # Use path context rather than Git context as we want local files
          file: ./dockerfiles/Dockerfile
          context: .
          target: ${{ matrix.target }}
          outputs: type=image,name=${{ inputs.registry }}/${{ inputs.image }},push-by-digest=true,name-canonical=true,push=true
          platforms: linux/${{ matrix.platform }}
          # Must be disabled to provide legacy format images from the registry
          provenance: false
          push: true
          load: false
          build-args: |
            FLB_NIGHTLY_BUILD=${{ inputs.unstable }}
            RELEASE_VERSION=${{ inputs.version }}
            WAMR_BUILD_TARGET=${{ (contains(matrix.platform, 'arm/v7') && 'ARMV7') || '' }}

      - name: Export ${{ matrix.target }} digest
        run: |
          mkdir -p /tmp/digests
          digest="${{ steps.build.outputs.digest }}"
          touch "/tmp/digests/${digest#sha256:}"
        shell: bash

      - name: Upload ${{ matrix.target }} digest
        uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.target }}-digests-${{ (contains(matrix.platform, 'arm/v7') && 'arm-v7') || matrix.platform }}
          path: /tmp/digests/*
          if-no-files-found: error
          retention-days: 1

  # Take the digests and produce a multi-arch manifest from them.
  call-build-container-image-manifests:
    permissions:
      contents: read
      packages: write
    name: Upload multi-arch container image manifests
    runs-on: ubuntu-latest
    needs:
      - call-build-images-meta
      - call-build-single-arch-container-images
    outputs:
      version: ${{ steps.meta.outputs.version }}
    steps:
      - name: Extract metadata from Github
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ inputs.registry }}/${{ inputs.image }}
          tags: |
            raw,${{ inputs.version }}
            raw,${{ needs.call-build-images-meta.outputs.major-version }}
            raw,latest

      - name: Download production digests
        uses: actions/download-artifact@v4
        with:
          pattern: production-digests-*
          path: /tmp/production-digests
          merge-multiple: true

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to the Container registry
        uses: docker/login-action@v3
        with:
          registry: ${{ inputs.registry }}
          username: ${{ github.actor }}
          password: ${{ secrets.token }}

      - name: Create production manifest
        run: |
          docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
            $(printf '${{ inputs.registry }}/${{ inputs.image }}@sha256:%s ' *)
        shell: bash
        working-directory: /tmp/production-digests

      - name: Inspect image
        run: |
          docker buildx imagetools inspect ${{ inputs.registry }}/${{ inputs.image }}:${{ steps.meta.outputs.version }}
        shell: bash

  # Take the digests and produce a multi-arch manifest from them.
  call-build-debug-container-image-manifests:
    permissions:
      contents: read
      packages: write
    name: Upload debug multi-arch container image manifests
    runs-on: ubuntu-latest
    needs:
      - call-build-images-meta
      - call-build-single-arch-container-images
    outputs:
      version: ${{ steps.debug-meta.outputs.version }}
    steps:
      - id: debug-meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ inputs.registry }}/${{ inputs.image }}
          tags: |
            raw,${{ inputs.version }}-debug
            raw,${{ needs.call-build-images-meta.outputs.major-version }}-debug
            raw,latest-debug

      - name: Download debug digests
        uses: actions/download-artifact@v4
        with:
          pattern: debug-digests-*
          path: /tmp/debug-digests
          merge-multiple: true

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to the Container registry
        uses: docker/login-action@v3
        with:
          registry: ${{ inputs.registry }}
          username: ${{ github.actor }}
          password: ${{ secrets.token }}

      - name: Create debug manifest
        run: |
          docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
            $(printf '${{ inputs.registry }}/${{ inputs.image }}@sha256:%s ' *)
        shell: bash
        working-directory: /tmp/debug-digests

      - name: Inspect image
        run: |
          docker buildx imagetools inspect ${{ inputs.registry }}/${{ inputs.image }}:${{ steps.debug-meta.outputs.version }}
        shell: bash

  call-build-images-generate-schema:
    needs:
      - call-build-images-meta
      - call-build-container-image-manifests
    runs-on: ubuntu-latest
    environment: ${{ inputs.environment }}
    permissions:
      contents: read
      packages: read
    steps:
      - name: Log in to the Container registry
        uses: docker/login-action@v3
        with:
          registry: ${{ inputs.registry }}
          username: ${{ inputs.username }}
          password: ${{ secrets.token }}

      - name: Generate schema
        run: |
          docker run --rm -t ${{ inputs.registry }}/${{ inputs.image }}:${{ inputs.version }} -J > fluent-bit-schema-${{ inputs.version }}.json
          cat fluent-bit-schema-${{ inputs.version }}.json | jq -M > fluent-bit-schema-pretty-${{ inputs.version }}.json
        shell: bash

      - name: Upload the schema
        uses: actions/upload-artifact@v4
        with:
          path: ./fluent-bit-schema*.json
          name: fluent-bit-schema-${{ inputs.version }}
          if-no-files-found: error

  call-build-images-scan:
    needs:
      - call-build-images-meta
      - call-build-container-image-manifests
    name: Trivy + Dockle image scan
    runs-on: ubuntu-latest
    environment: ${{ inputs.environment }}
    permissions:
      contents: read
      packages: read
    steps:
      - name: Log in to the Container registry
        uses: docker/login-action@v3
        with:
          registry: ${{ inputs.registry }}
          username: ${{ inputs.username }}
          password: ${{ secrets.token }}

      - name: Trivy - multi-arch
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: "${{ inputs.registry }}/${{ inputs.image }}:${{ inputs.version }}"
          format: "table"
          exit-code: "1"
          ignore-unfixed: true
          vuln-type: "os,library"
          severity: "CRITICAL,HIGH"

      - name: Dockle - multi-arch
        uses: hands-lab/dockle-action@v1
        with:
          image: "${{ inputs.registry }}/${{ inputs.image }}:${{ inputs.version }}"
          exit-code: "1"
          exit-level: WARN

  call-build-images-sign:
    needs:
      - call-build-images-meta
      - call-build-container-image-manifests
      - call-build-debug-container-image-manifests
    name: Deploy and sign multi-arch container image manifests
    permissions:
      contents: read
      packages: write
      # This is used to complete the identity challenge
      # with sigstore/fulcio when running outside of PRs.
      id-token: write
    runs-on: ubuntu-latest
    environment: ${{ inputs.environment }}
    steps:
      - name: Install cosign
        uses: sigstore/cosign-installer@v2

      - name: Cosign keyless signing using Rektor public transparency log
        # This step uses the identity token to provision an ephemeral certificate
        # against the sigstore community Fulcio instance, and records it to the
        # sigstore community Rekor transparency log.
        #
        # We use recursive signing on the manifest to cover all the images.
        run: |
          cosign sign --recursive --force \
            -a "repo=${{ github.repository }}" \
            -a "workflow=${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
            -a "ref=${{ github.sha }}" \
            -a "release=${{ inputs.version }}" \
            "${{ inputs.registry }}/${{ inputs.image }}@${{ needs.call-build-container-image-manifests.outputs.version }}" \
            "${{ inputs.registry }}/${{ inputs.image }}@${{ needs.call-build-debug-container-image-manifests.outputs.version }}"
        shell: bash
        # Ensure we move on to key-based signing as well
        continue-on-error: true
        env:
          COSIGN_EXPERIMENTAL: true

      - name: Cosign with a key
        # Only run if we have a key defined
        if: ${{ env.COSIGN_PRIVATE_KEY }}
        # The key needs to cope with newlines
        run: |
          echo -e "${COSIGN_PRIVATE_KEY}" > /tmp/my_cosign.key
          cosign sign --key /tmp/my_cosign.key --recursive --force \
            -a "repo=${{ github.repository }}" \
            -a "workflow=${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
            -a "ref=${{ github.sha }}" \
            -a "release=${{ inputs.version }}" \
            "${{ inputs.registry }}/${{ inputs.image }}@${{ needs.call-build-container-image-manifests.outputs.version }}" \
            "${{ inputs.registry }}/${{ inputs.image }}@${{ needs.call-build-debug-container-image-manifests.outputs.version }}"
          rm -f /tmp/my_cosign.key
        shell: bash
        continue-on-error: true
        env:
          COSIGN_PRIVATE_KEY: ${{ secrets.cosign_private_key }}
          COSIGN_PASSWORD: ${{ secrets.cosign_private_key_password }} # optional

  # This takes a long time...
  call-build-windows-container:
    name: Windows container images
    runs-on: windows-${{ matrix.windows-base-version }}
    environment: ${{ inputs.environment }}
    needs:
      - call-build-images-meta
    strategy:
      fail-fast: true
      matrix:
        windows-base-version:
          - '2019'
          - '2022'
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.ref }}

      - name: Log in to the Container registry
        uses: docker/login-action@v3
        with:
          registry: ${{ inputs.registry }}
          username: ${{ inputs.username }}
          password: ${{ secrets.token }}

      - name: Build the production images
        run: |
          docker build -t ${{ inputs.registry }}/${{ inputs.image }}:windows-${{ matrix.windows-base-version }}-${{ inputs.version }} --build-arg FLB_NIGHTLY_BUILD=${{ inputs.unstable }} --build-arg WINDOWS_VERSION=ltsc${{ matrix.windows-base-version }} -f ./dockerfiles/Dockerfile.windows .
          docker push ${{ inputs.registry }}/${{ inputs.image }}:windows-${{ matrix.windows-base-version }}-${{ inputs.version }}

        # We cannot use this action as it requires privileged mode
        # uses: docker/build-push-action@v6
        # with:
        #   file: ./dockerfiles/Dockerfile.windows
        #   context: .
        #   tags: ${{ steps.meta.outputs.tags }}
        #   labels: ${{ steps.meta.outputs.labels }}
        #   platforms: windows/amd64
        #   target: runtime
        #   push: true
        #   load: false
        #   build-args: |
        #     FLB_NIGHTLY_BUILD=${{ inputs.unstable }}
        #     WINDOWS_VERSION=ltsc2019