docker.yaml

on:
  pull_request:
    branches:
      - master
  push:
    branches:
      - master
  workflow_dispatch:

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

env:
  GCS_BUCKET: images.metal-pod.io
  ACTIONS_ALLOW_UNSECURE_COMMANDS: true

jobs:
  debian-ubuntu:
    name: Build Debian and Ubuntu based OS images
    runs-on: self-hosted

    strategy:
      matrix:
        os:
          - name: debian
            version: 13
          - name: ubuntu
            version: 24.04

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: metal-stack
          password: ${{ secrets.GITHUB_TOKEN }}

      - uses: google-github-actions/auth@v2
        with:
          credentials_json: '${{ secrets.GCP_SA_KEY }}'

      - name: Set up Cloud SDK
        uses: google-github-actions/setup-gcloud@v2

      - name: Set up Go 1.25
        uses: actions/setup-go@v5
        with:
          go-version: '1.25.x'
          cache: false

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Make SEMVER_PATCH
        run: |
          [ "${GITHUB_EVENT_NAME}" == 'pull_request' ] && echo "SEMVER_PATCH=-${GITHUB_HEAD_REF##*/}" >> $GITHUB_ENV || true
          [ "${GITHUB_EVENT_NAME}" == 'push' ] && echo "SEMVER_PATCH=" >> $GITHUB_ENV || true

      - name: Lint
        uses: golangci/golangci-lint-action@v8
        with:
          args: --build-tags integration --timeout=3m

      - name: build install
        run: make

      - name: Prepare build environment
        shell: bash
        run: ./prepare.sh ${{ matrix.os.name }}
        env:
          SEMVER_MAJOR_MINOR: ${{ matrix.os.version }}

      - name: use our lz4 which is version 1.10 with multithread support
        shell: bash
        run: |
          chmod +x test/lz4
          sudo cp test/lz4 /usr/bin/lz4

      - name: Build docker image for workers
        uses: docker/bake-action@v6
        with:
          source: .
          files: ./docker-bake.hcl
          targets: ${{ matrix.os.name }}
          no-cache: true

          # target: _common
          # field: output
          # modifier: += (append)
          # value = type=registry
          # take a look at the docs for further info on how to append targets etc.
          # append to target: https://docs.docker.com/reference/cli/docker/buildx/bake/#set
          # GitHub Actions syntax: https://github.com/marketplace/actions/docker-buildx-bake
          set: _common.output+=type=registry
        env:
          OS_NAME: ${{ matrix.os.name }}
          SEMVER_MAJOR_MINOR: ${{ matrix.os.version }}
          SEMVER_PATCH: ${{ env.SEMVER_PATCH }}

      - name: Test and export docker image for workers
        run: |
          ./test.sh
          ./export.sh
        env:
          CIS_VERSION: v4.1-4
          IMG_PKG_COMMAND: dpkg -l
          OS_NAME: ${{ matrix.os.name }}
          SEMVER_MAJOR_MINOR: ${{ matrix.os.version }}
          SEMVER_PATCH: ${{ env.SEMVER_PATCH }}

      - name: Prepare build environment
        shell: bash
        run: ./prepare.sh firewall
        env:
          SEMVER_MAJOR_MINOR: 3.0-ubuntu
        if: ${{ matrix.os.name == 'ubuntu' }}

      - name: Build docker image for firewalls
        uses: docker/bake-action@v6
        with:
          source: .
          files: ./docker-bake.hcl
          targets: ubuntu-firewall
          no-cache: true
          set: _common.output+=type=registry
        env:
          OS_NAME: firewall
          SEMVER_MAJOR_MINOR: 3.0-ubuntu
          SEMVER_PATCH: ${{ env.SEMVER_PATCH }}
        if: ${{ matrix.os.name == 'ubuntu' }}

      # TODO enable debian build again, actually droptailer and firewall-controller did not get enabled
      # and then goss tests fail
      - name: Test and export docker image for firewalls
        run: |
          ./test.sh
          ./export.sh
        env:
          IMG_PKG_COMMAND: dpkg -l
          OS_NAME: firewall
          SEMVER_MAJOR_MINOR: 3.0-ubuntu
          SEMVER_PATCH: ${{ env.SEMVER_PATCH }}
        if: ${{ matrix.os.name == 'ubuntu' }}

      - name: Prepare build environment
        shell: bash
        run: ./prepare.sh capms-ubuntu
        env:
          SEMVER_MAJOR_MINOR: 1.32.9
        if: ${{ matrix.os.name == 'ubuntu' }}

      - name: Build docker image for capms
        uses: docker/bake-action@v6
        with:
          source: .
          files: ./docker-bake.hcl
          targets: ubuntu-capms
          no-cache: true
          set: _common.output+=type=registry
        env:
          KUBE_VERSION: 1.32.9
          KUBE_APT_BRANCH: v1.32
          OS_NAME: capms-ubuntu
          SEMVER_MAJOR_MINOR: 1.32.9
          SEMVER_PATCH: ${{ env.SEMVER_PATCH }}
        if: ${{ matrix.os.name == 'ubuntu' }}

      - name: Test and export docker image for capms
        run: |
          ./test.sh
          ./export.sh
        env:
          IMG_PKG_COMMAND: dpkg -l
          OS_NAME: capms-ubuntu
          SEMVER_MAJOR_MINOR: 1.32.9
          SEMVER_PATCH: ${{ env.SEMVER_PATCH }}
        if: ${{ matrix.os.name == 'ubuntu' }}

      - name: Prepare build environment
        shell: bash
        run: ./prepare.sh debian-nvidia
        env:
          SEMVER_MAJOR_MINOR: ${{ matrix.os.version }}
        if: ${{ matrix.os.name == 'debian' }}

      - name: Build docker image for debian-nvidia
        uses: docker/bake-action@v6
        with:
          source: .
          files: ./docker-bake.hcl
          targets: debian-nvidia
          no-cache: true
          set: _common.output+=type=registry
        env:
          OS_NAME: debian-nvidia
          SEMVER_MAJOR_MINOR: ${{ matrix.os.version }}
          SEMVER_PATCH: ${{ env.SEMVER_PATCH }}
        if: ${{ matrix.os.name == 'debian' }}

      - name: Test and export docker image for debian-nvidia based workers
        run: |
          ./export.sh
        env:
          IMG_PKG_COMMAND: dpkg -l
          OS_NAME: debian-nvidia
          SEMVER_MAJOR_MINOR: ${{ matrix.os.version }}
          SEMVER_PATCH: ${{ env.SEMVER_PATCH }}
        if: ${{ matrix.os.name == 'debian' }}

      - name: Upload image tarballs to GCS
        run: cd images && gsutil -m -h "Cache-Control:no-store" cp -r . gs://$GCS_BUCKET/metal-os/pull_requests/

  almalinux:
    name: Build Almalinux based OS image
    runs-on: self-hosted
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: metal-stack
          password: ${{ secrets.GITHUB_TOKEN }}

      - uses: google-github-actions/auth@v2
        with:
          credentials_json: '${{ secrets.GCP_SA_KEY }}'

      - name: Set up Cloud SDK
        uses: google-github-actions/setup-gcloud@v2

      - name: Set up Go 1.25
        uses: actions/setup-go@v5
        with:
          go-version: '1.25.x'
          cache: false

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Make SEMVER_PATCH
        run: |
          [ "${GITHUB_EVENT_NAME}" == 'pull_request' ] && echo "SEMVER_PATCH=-${GITHUB_HEAD_REF##*/}" >> $GITHUB_ENV || true
          [ "${GITHUB_EVENT_NAME}" == 'push' ] && echo "SEMVER_PATCH=" >> $GITHUB_ENV || true

      - name: build install
        run: make

      - name: Prepare build environment
        shell: bash
        run: ./prepare.sh almalinux
        env:
          SEMVER_MAJOR_MINOR: 9

      - name: Build image
        uses: docker/bake-action@v6
        with:
          source: .
          files: ./docker-bake.hcl
          targets: almalinux
          no-cache: true
          set: _common.output+=type=registry
        env:
          OS_NAME: almalinux
          SEMVER_MAJOR_MINOR: 9
          SEMVER_PATCH: ${{ env.SEMVER_PATCH }}

      - name: Test and export docker image for almalinux based workers
        run: |
          ./test.sh
          ./export.sh
        env:
          IMG_PKG_COMMAND: rpm -qa
          OS_NAME: almalinux
          SEMVER_MAJOR_MINOR: 9
          SEMVER_PATCH: ${{ env.SEMVER_PATCH }}

      - uses: google-github-actions/setup-gcloud@v0
        with:
          service_account_email: ${{ secrets.GCP_SA_EMAIL }}
          service_account_key: ${{ secrets.GCP_SA_KEY }}

      - name: Upload image tarballs to GCS
        run: cd images && gsutil -m -h "Cache-Control:no-store" cp -r . gs://$GCS_BUCKET/metal-os/pull_requests/