build.yml

name: Docker Image CI

on:
  push:
    branches: [main]
  workflow_dispatch:
    inputs:
      shim_version:
        description: 'Version of the shim to build'
        required: true
        default: '0.6.0'

env:
  shim_version: ${{ github.events.inputs.shim_version || '0.6.0' }}
  chart_version: 0.1.0

permissions:
  contents: read
  packages: write

jobs:
  build-and-push:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        platform: [linux/amd64, linux/arm64]
    steps:
      - uses: actions/checkout@v3
      - uses: docker/setup-qemu-action@v2
      - uses: docker/setup-buildx-action@v2
      - uses: azure/setup-helm@v3

      - name: Login to ghcr
        uses: docker/login-action@v2
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Docker - Metadata
        id: meta
        uses: docker/metadata-action@v4
        with:
          images: |
            ghcr.io/${{ github.repository }}
          tags: |
            ${{ env.shim_version }}-{{ sha }}
            ${{ env.shim_version }}

      - name: Docker - Build and Push
        uses: docker/build-push-action@v4
        with:
          context: ./image
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            SHIM_VERSION=${{ env.shim_version }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Helm - Release
        if: github.ref == 'refs/heads/main'
        run: |
          echo ${{ secrets.GITHUB_TOKEN }} | helm registry login ghcr.io/${{ github.repository_owner }} --username ${{ github.actor }} --password-stdin
          helm package ./chart --version ${{ env.chart_version }} --app-version ${{ env.shim_version }}
          helm push ./spin-containerd-shim-installer-${{ env.chart_version }}.tgz oci://ghcr.io/${{ github.repository_owner }}/charts

      - name: clear local credentials
        if: always()
        run: |
          rm -f ${HOME}/.docker/config.json
          rm -f ${HOME}/.config/helm/registry/config.json