.build.yaml

name: Reusable build workflow

on:
  workflow_call:
    inputs:
      image:
        required: true
        type: string
      melange-config:
        required: false
        type: string
        default: ''
      registry:
        required: false
        type: string
        default: ''

jobs:
  build:
    runs-on: ${{ matrix.runner }}
    if: inputs.melange-config != ''
    strategy:
      fail-fast: false
      matrix:
        arch: ["x86_64", "aarch64"]
        include:
          - arch: "aarch64"
            runner: "ubuntu-latest-arm"
          - arch: "x86_64"
            runner: "ubuntu-latest"

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
        with:
          egress-policy: audit

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      # TODO: Replace this with custom wolfi image
      - run: |
          sudo apt update -y && \
          sudo apt install unzip curl cmake pkg-config -y

      - id: melange
        uses: chainguard-dev/actions/melange-build@main
        with:
          multi-config: ${{ inputs.melange-config }}
          empty-workspace: false
          workdir: images/${{ inputs.image }}
          sign-with-temporary-key: true
          archs: ${{ matrix.arch }}

      - name: 'Upload built packages archive to Github Artifacts'
        uses: actions/upload-artifact@v4
        with:
          name: ${{ inputs.image }}-${{ matrix.arch }}
          path: ./packages
          retention-days: 1 # Low ttl since this is just an intermediary used once
          if-no-files-found: error

  publish:
    runs-on: ubuntu-latest
    needs: build
    if: always() && (needs.build.result == 'success' || needs.build.result == 'skipped')
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
        with:
          egress-policy: audit

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      # TODO: Replace this with custom wolfi image
      - run: |
          sudo apt update -y && \
          sudo apt install unzip curl git -y

      - uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: '1.5.*'
          terraform_wrapper: false

      # Setup melange
      - uses: chainguard-dev/actions/setup-melange@main
        if: inputs.melange-config != ''

      # Fetch the build stages back down
      - name: 'Download package archives'
        if: inputs.melange-config != ''
        uses: actions/download-artifact@v4
        with:
          name: ${{ inputs.image }}-aarch64
          path: ./packages

      - name: 'Download package archives'
        if: inputs.melange-config != ''
        uses: actions/download-artifact@v4
        with:
          name: ${{ inputs.image }}-x86_64
          path: ./packages

      # Prepare the index for terraform
      - if: inputs.melange-config != ''
        run: |
          # Generate a single key expected by the terraform build
          melange keygen melange.rsa

          for arch in "x86_64" "aarch64"; do
            # Not strictly needed, but might as well while we're here
            melange sign -k melange.rsa packages/$arch/*.apk

            # Rebuild the index
            melange index -o packages/$arch/APKINDEX.tar.gz packages/$arch/*.apk
            melange sign-index --signing-key melange.rsa packages/$arch/APKINDEX.tar.gz
          done

      # Setup local registry
      - uses: chainguard-dev/actions/setup-registry@main
        if: inputs.registry == ''
        with:
          port: 5000

      # Auth to GitHub Container Registry (ghcr.io)
      - name: Login to registry
        if: inputs.registry != ''
        run: |
          set -x
          echo "${{ github.token }}" | docker login \
            -u "${{ github.repository_owner }}" \
            --password-stdin ghcr.io

      # Build and push image using terraform-provider-apko
      - name: Build image with apko/terraform
        env:
          TF_VAR_target_repository: ${{ inputs.registry != '' && inputs.registry || format('localhost:5000/{0}', inputs.image) }}
        run: |
          set -x
          terraform init
          terraform apply -auto-approve -target=module.${{inputs.image}}