container-image.yml

name: Build container image

on:
  workflow_call:
    outputs:
      digest:
        description: "Image digest"
        value: ${{ jobs.build.outputs.digest }}

jobs:
  cross-build:
    name: Cross compile policy-server binary
    runs-on: ubuntu-latest

    strategy:
      matrix:
        targetarch:
          - aarch64
          - x86_64

    steps:
      - name: Checkout code
        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6

      - name: Setup rust toolchain
        uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1.0.7
        with:
          toolchain: stable
          target: ${{matrix.targetarch}}-unknown-linux-musl
          override: true

      - uses: actions-rs/cargo@844f36862e911db73fe0815f00a4a2602c279505 # v1.0.3
        with:
          use-cross: true
          command: build
          args: --release --target ${{matrix.targetarch}}-unknown-linux-musl

      - name: Upload policy-server binary
        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
        with:
          name: policy-server-${{ matrix.targetarch }}
          path: |
            target/${{ matrix.targetarch }}-unknown-linux-musl/release/policy-server

  build:
    name: Build container image
    permissions:
      packages: write
    needs:
      - cross-build
    runs-on: ubuntu-latest
    outputs:
      repository: ${{ steps.setoutput.outputs.repository }}
      tag: ${{ steps.setoutput.outputs.tag }}
      artifact: ${{ steps.setoutput.outputs.artifact }}
      digest: ${{ steps.setoutput.outputs.digest }}
    steps:
      - name: Checkout code
        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
      - name: Set up QEMU
        uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3.0.0
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@d70bba72b1f3fd22344832f00baa16ece964efeb # v3.3.0
      - name: Login to GitHub Container Registry
        uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20 # v3.1.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # Download the policy-server artifacts we've built inside of the previous job
      - name: Download policy-server-x86_64 artifact
        uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
        with:
          name: policy-server-x86_64
          path: artifacts-x86_64
      - name: Download policy-server-aarch64 artifact
        uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
        with:
          name: policy-server-aarch64
          path: artifacts-aarch64
      - name: Move binaries to project root
        run: |
          mv artifacts-x86_64/policy-server policy-server-x86_64
          mv artifacts-aarch64/policy-server policy-server-aarch64

      - name: Retrieve tag name (main branch)
        if: ${{ startsWith(github.ref, 'refs/heads/main') }}
        run: |
          echo TAG_NAME=latest >> $GITHUB_ENV
      - name: Retrieve tag name (feat branch)
        if: ${{ startsWith(github.ref, 'refs/heads/feat') }}
        run: |
          echo "TAG_NAME=latest-$(echo ${GITHUB_REF#refs/heads/})" >> $GITHUB_ENV
      - name: Retrieve tag name (tag)
        if: ${{ startsWith(github.ref, 'refs/tags/') }}
        run: |
          echo TAG_NAME=$(echo $GITHUB_REF | sed -e "s|refs/tags/||") >> $GITHUB_ENV
      - name: Push and push container image
        id: build-image
        uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0
        with:
          context: .
          file: ./Dockerfile.github
          platforms: linux/amd64, linux/arm64
          push: true
          tags: |
            ghcr.io/${{github.repository_owner}}/policy-server:${{ env.TAG_NAME }}
      - id: setoutput
        name: Set output parameters
        run: |
          echo "digest=${{ steps.build-image.outputs.digest }}" >> $GITHUB_OUTPUT