docker.yaml

name: Build and Publish Docker Image

on:
  push:
    branches:
      - 'main'
  pull_request:
    branches:
      - 'main'
  workflow_dispatch:
    inputs:
      tag:
        description: 'Git ref (branch or tag) to build'
        required: true
        type: string
      pkcs11:
        description: 'Bundle PKCS#11 provider libs (SoftHSM2 + OpenSC) in the runtime image'
        required: false
        default: false
        type: boolean

env:
  REGISTRY: ghcr.io
  ORG: ${{ github.repository_owner }}
  IMAGE_NAME: kms

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

jobs:
  build:
    permissions:
      packages: write
      contents: read
    timeout-minutes: 60
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: linux/amd64
            runner: ubuntu-24.04
          - platform: linux/arm64
            runner: ubuntu-24.04-arm
    runs-on: ${{ matrix.runner }}
    name: build (${{ matrix.platform }})
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          # On workflow_dispatch, build the caller-specified ref. On push events
          # inputs.tag is empty, which checkout treats as the triggering commit.
          ref: ${{ inputs.tag }}
          # Full history + tags so the Makefile's git-describe version stamp works.
          fetch-depth: 0

      - name: Prepare platform pair
        run: |
          platform="${{ matrix.platform }}"
          echo "PLATFORM_PAIR=${platform//\//-}" >> "$GITHUB_ENV"

      - name: Resolve KMS_VERSION
        run: |
          # Same default as the Makefile's KMS_VERSION.
          echo "KMS_VERSION=$(git describe --tags --always --dirty 2>/dev/null || echo '0.1.0-dev')" >> "$GITHUB_ENV"

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0

      - name: Log in to Container Registry
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push by digest
        id: build
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          file: Dockerfile
          platforms: ${{ matrix.platform }}
          # Mirrors `make docker-build`.
          build-args: |
            KMS_VERSION=${{ env.KMS_VERSION }}
            PKCS11=${{ inputs.pkcs11 || false }}
          outputs: type=image,name=${{ env.REGISTRY }}/${{ env.ORG }}/${{ env.IMAGE_NAME }},push-by-digest=true,name-canonical=true,push=true
          cache-from: type=gha,scope=kms-${{ env.PLATFORM_PAIR }}
          cache-to: type=gha,mode=max,scope=kms-${{ env.PLATFORM_PAIR }}

      - name: Export digest
        run: |
          mkdir -p "${{ runner.temp }}/digests"
          digest="${{ steps.build.outputs.digest }}"
          touch "${{ runner.temp }}/digests/${digest#sha256:}"

      - name: Upload digest
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: digests-${{ env.PLATFORM_PAIR }}
          path: ${{ runner.temp }}/digests/*
          if-no-files-found: error
          retention-days: 1

  merge:
    needs: build
    permissions:
      packages: write
      contents: read
    runs-on: ubuntu-latest
    timeout-minutes: 5
    env:
      TAG: ${{ github.event.inputs.tag || (github.event_name == 'push' && github.ref == 'refs/heads/main' && 'latest') || github.ref_name }}
    steps:
      - name: Download digests
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          path: ${{ runner.temp }}/digests
          pattern: digests-*
          merge-multiple: true

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0

      - name: Log in to Container Registry
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Prepare Docker tag
        id: tags
        env:
          EVENT_NAME: ${{ github.event_name }}
          GIT_REF: ${{ github.ref }}
        run: |
          set -euo pipefail
          DOCKER_TAG="${TAG//[^a-zA-Z0-9._-]/-}"
          # Sanitizing can also yield `latest` from a ref named `latest`, so
          # re-check ownership after rewriting rather than before.
          if [[ "$DOCKER_TAG" == "latest" && ! ( "$EVENT_NAME" == "push" && "$GIT_REF" == "refs/heads/main" ) ]]; then
            echo "::error::refusing to publish 'latest' from $EVENT_NAME on $GIT_REF"
            exit 1
          fi
          # Reject what Docker would not accept as a tag, rather than letting
          # imagetools fail later with an opaque reference-parse error.
          if [[ ! "$DOCKER_TAG" =~ ^[a-zA-Z0-9_][a-zA-Z0-9._-]{0,127}$ ]]; then
            echo "::error::ref did not yield a usable image tag: $DOCKER_TAG"
            exit 1
          fi
          echo "DOCKER_TAG=$DOCKER_TAG" >> "$GITHUB_OUTPUT"

      - name: Create manifest list and push
        working-directory: ${{ runner.temp }}/digests
        run: |
          docker buildx imagetools create \
            -t "${{ env.REGISTRY }}/${{ env.ORG }}/${{ env.IMAGE_NAME }}:${{ steps.tags.outputs.DOCKER_TAG }}" \
            $(printf '${{ env.REGISTRY }}/${{ env.ORG }}/${{ env.IMAGE_NAME }}@sha256:%s ' *)

      - name: Inspect manifest
        run: |
          docker buildx imagetools inspect \
            "${{ env.REGISTRY }}/${{ env.ORG }}/${{ env.IMAGE_NAME }}:${{ steps.tags.outputs.DOCKER_TAG }}"