upload_oci.yml

name: upload to OCI
on:
  workflow_call:
    inputs:
      version:
        type: string
        default: today
      upload_version:
        type: string
        default: ""
      flavor_filter:
        type: string
        default: '--exclude "bare-*"'
jobs:
  generate_matrix_publish:
    name: Generate flavors matrix to publish
    uses: gardenlinux/gardenlinux/.github/workflows/build_flavors_matrix.yml@bd5e711d06acb6e93da02deb47ad2ce569af0914
    with:
      flags: '${{ inputs.flavor_filter }} --no-arch --json-by-arch --build --test'
  upload_gl_artifacts:
    name: upload to OCI
    needs: [ generate_matrix_publish ]
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash
    env:
      CNAME: ''
    permissions:
      id-token: write
      packages: write
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.generate_matrix_publish.outputs.matrix) }}
      max-parallel: 8
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          submodules: true
      - uses: oras-project/setup-oras@1d808f7d7f6995cc68b7bf507bfe5c5446e1dc9d # v2
      - run: oras version
      - name: Install python-gardenlinux-lib
        uses: gardenlinux/python-gardenlinux-lib/.github/actions/setup@efdffb9a6b279cd7aada23b02baf4ec2534dc6d2
      - name: Install cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
        with:
          cosign-release: 'v3.1.3'
      - name: Set flavor version reference
        run: |
          git rev-parse HEAD | cut -c1-8 | tee COMMIT
          echo "${{ inputs.version }}" | tee VERSION
      - name: Set CNAME
        run: |
          echo "CNAME=$(gl-features-parse --cname ${{ matrix.flavor }}-${{ matrix.arch }} cname)" | tee -a "$GITHUB_ENV"
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: build-${{ matrix.flavor }}-${{ matrix.arch }}
      - name: Push using the glcli util
        env:
          GL_CLI_REGISTRY_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GL_CLI_REGISTRY_USERNAME: ${{ github.repository_owner }}
        run: |
          mkdir "$CNAME"

          tar -C "$CNAME" -xzf "$CNAME.tar.gz"

          gl-oci push-manifest \
            --dir "${CNAME}" \
            --container "ghcr.io/${{ github.repository }}" \
            --arch ${{ matrix.arch }} \
            --version ${{ inputs.version }} \
            --cname "${CNAME}" \
            --cosign_file digest.txt \
            --manifest_file "oci_manifest_entry_${CNAME}.json"
      - name: Add additional semver tag
        run: |
          echo ${{ secrets.GITHUB_TOKEN }} | oras login -u ${{ github.repository_owner }} --password-stdin ghcr.io
          COMMIT_SHA_SHORT=$(git rev-parse HEAD | cut -c1-8)
          # Keep CNAME reference
          CNAME2=${CNAME//_/-}
          # Remove version from CNAME
          CNAME2=${CNAME2//-${{ inputs.version }}/}
          # Remove commit sha from CNAME
          CNAME2=${CNAME2//-${COMMIT_SHA_SHORT}/}
          # 8 charachter commit hash
          DASHED_VERSION=${{ inputs.upload_version || inputs.version }}
          DASHED_VERSION=${DASHED_VERSION//./-}

          echo "Adding additional tag: ${{ inputs.upload_version || inputs.version }}-${CNAME2}-${DASHED_VERSION}-${COMMIT_SHA_SHORT}"
          oras tag ghcr.io/${{ github.repository }}:${{ inputs.version }}-${CNAME}-${{ matrix.arch }} ${{ inputs.upload_version || inputs.version }}-${CNAME2}-${DASHED_VERSION}-${COMMIT_SHA_SHORT}
      - uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: oci_manifest_entry_${{ env.CNAME }}.json
          key: oci-manifest-${{ matrix.flavor }}-${{ matrix.arch }}-${{ github.run_id }}
      - name: Output digest to be signed
        run: |
          cat digest.txt

  upload_manifests_entries:
    needs: [ generate_matrix_publish, upload_gl_artifacts ]
    name: upload manifest entries into OCI index
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash
    env:
      CNAME: ''
    permissions:
      id-token: write
      packages: write
      actions: write
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.generate_matrix_publish.outputs.matrix) }}
      max-parallel: 1
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          submodules: true
      - name: Install python-gardenlinux-lib
        uses: gardenlinux/python-gardenlinux-lib/.github/actions/setup@efdffb9a6b279cd7aada23b02baf4ec2534dc6d2
      - name: Set flavor version reference
        run: |
          git rev-parse HEAD | cut -c1-8 | tee COMMIT
          echo "${{ inputs.version }}" | tee VERSION
      - name: Set CNAME
        run: |
          echo "CNAME=$(gl-features-parse --cname ${{ matrix.flavor }}-${{ matrix.arch }} cname)" | tee -a "$GITHUB_ENV"
      - uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: oci_manifest_entry_${{ env.CNAME }}.json
          key: oci-manifest-${{ matrix.flavor }}-${{ matrix.arch }}-${{ github.run_id }}
      - name: Update index using glcli tool
        env:
          GL_CLI_REGISTRY_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GL_CLI_REGISTRY_USERNAME: ${{ github.repository_owner }}
        run: |
          mkdir manifests
          mv oci_manifest_entry_${CNAME}.json manifests/

          gl-oci push-index-from-directory \
            --index "ghcr.io/${{ github.repository }}" \
            --index-tag ${{ inputs.upload_version || inputs.version }} \
            --manifest_folder manifests