build-image-base.yaml

name: Auto Build Image Base

env:
  IMAGE_REPO: ${{ github.repository }}
  ONLINE_REGISTER: ghcr.io
  BUILD_PLATFORM: linux/amd64,linux/arm64
  ONLINE_REGISTER_USER: ${{ github.actor }}
  ONLINE_REGISTER_PASSWORD: ${{ secrets.GITHUB_TOKEN }}

on:
  pull_request_target:
    types:
      - opened
      - synchronize
      - reopened
    paths:
      - images/agent-base/**
      - images/controller-base/**
      - images/nettools-base/**
  push:
    branches:
      - main
    paths:
      - images/agent-base/**
      - images/controller-base/**
      - images/nettools-base/**
  workflow_dispatch:
    inputs:
      ref:
        description: 'sha, tag, branch'
        required: true
        default: main


permissions: write-all

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
  cancel-in-progress: true

jobs:
  build-and-push:
    timeout-minutes: 30
    environment: release-base-images
    runs-on: ubuntu-latest
    strategy:
      matrix:
        include:
          - name: agent-base
            context: ./images/agent-base
          - name: controller-base
            context: ./images/controller-base
          - name: nettools-base
            context: ./images/controller-base

    steps:
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3.3.0

      - name: Inspect builder
        run: |
          echo "Name:      ${{ steps.buildx.outputs.name }}"
          echo "Endpoint:  ${{ steps.buildx.outputs.endpoint }}"
          echo "Status:    ${{ steps.buildx.outputs.status }}"
          echo "Flags:     ${{ steps.buildx.outputs.flags }}"
          echo "Platforms: ${{ steps.buildx.outputs.platforms }}"

      - name: Set up QEMU
        id: qemu
        uses: docker/setup-qemu-action@v3.0.0

      - name: Get Code Version Before Checkout
        id: get_event_version
        continue-on-error: false
        run: |
          if ${{ github.event_name == 'workflow_dispatch' }}; then
            ref=${{ github.event.inputs.ref }}
            echo "use re $ref , by workflow_dispatch"
            echo "RUN_event_ref=${ref}" >> $GITHUB_ENV
            echo "RUN_PUSH=true" >> $GITHUB_ENV
          elif ${{ github.event_name == 'pull_request_target' }} ; then
            #trigger by pr
            echo "use sha ${{ github.event.pull_request.head.sha }} , by pr"
            echo "RUN_event_ref=${{ github.event.pull_request.head.sha }}" >> $GITHUB_ENV
            echo "RUN_PUSH=false" >> $GITHUB_ENV
          elif ${{ github.event_name == 'push' }} ; then
            echo "use sha ${{ github.sha }} , by push"
            echo "RUN_event_ref=${{ github.sha }}" >> $GITHUB_ENV
            echo "RUN_PUSH=true" >> $GITHUB_ENV
          fi

      - name: Checkout Source Code
        uses: actions/checkout@v4
        with:
          persist-credentials: false
          # fetch-depth: 0
          ref: ${{ env.RUN_event_ref }}

      # after checkout code , could get the commit id of path ./images/baseimage , used for base image tag
      - name: Generating Base Image Tag
        id: base_tag
        run: |
          VERSION=$(git ls-tree --full-tree HEAD -- ${{ matrix.context }} | awk '{ print $3 }')
          echo "RUN_TAG=${VERSION}" >> $GITHUB_ENV

      # check whether we have upload the same base image to online register , if so, we could not build it
      - name: Checking if tag already exists
        id: tag-in-repositories
        shell: bash
        run: |
          if docker buildx imagetools inspect ${{ env.ONLINE_REGISTER }}/${{ env.IMAGE_REPO }}-${{ matrix.name }}:${{  env.RUN_TAG }} &>/dev/null; then
            echo "RUN_EXIST=true" >> $GITHUB_ENV
            echo "the target base image exist , no need to build it "
          else
            echo "RUN_EXIST=false" >> $GITHUB_ENV
            echo "the target base image does not exist , build it "
          fi

      - name: Login to online register
        if: ${{ env.RUN_EXIST == 'false' }}
        uses: docker/login-action@v3.3.0
        with:
          username: ${{ env.ONLINE_REGISTER_USER }}
          password: ${{ env.ONLINE_REGISTER_PASSWORD }}
          registry: ${{ env.ONLINE_REGISTER }}

      - name: Release build ${{ matrix.name }}
        if: ${{ env.RUN_EXIST == 'false' }}
        uses: docker/build-push-action@v6.5.0
        continue-on-error: false
        id: docker_build_release
        with:
          context: ${{ matrix.context }}
          file: ./${{ matrix.context }}/Dockerfile
          push: ${{ env.RUN_PUSH }}
          provenance: false
          github-token: ${{ secrets.WELAN_PAT }}
          platforms: ${{ env.BUILD_PLATFORM }}
          tags: |
            ${{ env.ONLINE_REGISTER }}/${{ env.IMAGE_REPO }}-${{ matrix.name }}:${{ env.RUN_TAG }}

      - name: Image Release Digest
        if: ${{ env.RUN_EXIST == 'false' }}
        shell: bash
        run: |
          mkdir -p image-digest/
          echo "## ${{ matrix.name }}" > image-digest/${{ matrix.name }}.txt
          echo "" >> image-digest/${{ matrix.name }}.txt
          echo "\`${{ env.ONLINE_REGISTER }}/${{ env.IMAGE_REPO }}-${{ matrix.name }}:${{ env.RUN_TAG }}@${{ steps.docker_build_release.outputs.digest }}\`" >> image-digest/${{ matrix.name }}.txt
          echo "" >> image-digest/${{ matrix.name }}.txt

      - name: Upload artifact digests
        if: ${{ env.RUN_EXIST == 'false' }}
        uses: actions/upload-artifact@v4.3.4
        with:
          name: image-digest-${{ matrix.name }}
          path: image-digest
          retention-days: 1

  image-digests:
    name: Display Digests
    runs-on: ubuntu-latest
    needs: build-and-push
    steps:
      - name: Downloading Image Digests
        shell: bash
        run: |
          mkdir -p image-digest/

      - name: Download digests of all images built
        uses: actions/download-artifact@v4.1.8
        with:
          path: image-digest/

      - name: Image Digests Output
        shell: bash
        run: |
          cd image-digest/
          find -type f | sort | xargs -d '\n' cat