build.yml

---
name: Build container image
on:
  pull_request:
    branches:
      - main
  schedule:
    - cron: '05 10 * * 1'  # 10:05am UTC every Monday
  push:
    branches:
      - main
    paths-ignore:
      - '**/README.md'
  workflow_dispatch:

env:
  IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}"  # do not edit

concurrency:
  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}-${{ inputs.brand_name}}-${{ inputs.stream_name }}
  cancel-in-progress: true

jobs:
  build_push:
    name: Build and push image
    runs-on: ubuntu-24.04

    permissions:
      contents: read
      packages: write
      id-token: write

    steps:
      # These stage versions are pinned by https://github.com/renovatebot/renovate
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - name: Maximize build space
        uses: ublue-os/remove-unwanted-software@695eb75bc387dbcd9685a8e72d23439d8686cba6

      - name: Install just
        uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 #v4.0.0

      - name: Check Just Syntax
        shell: bash
        run: |
          just check

      - name: Image Name
        id: image-name
        run: |
          IMAGE_NAME=$(just image_name)

          echo "IMAGE_NAME=${IMAGE_NAME}" >> $GITHUB_ENV

      - name: Default Tag
        id: gen-default-tag
        run: |
          DEFAULT_TAG=$(just generate-default-tag)

          echo "DEFAULT_TAG=${DEFAULT_TAG}" >> $GITHUB_ENV

      - name: Prepare environment
        run: |
          # Lowercase the image uri https://github.com/macbre/push-to-ghcr/issues/12
          echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" >> ${GITHUB_ENV}
          echo "IMAGE_NAME=${IMAGE_NAME,,}" >> ${GITHUB_ENV}

      # This actually builds the container image
      - name: Build Image
        id: build-image
        run: |
          sudo -E $(command -v just) build \
            ${IMAGE_NAME} \
            ${DEFAULT_TAG}

      # This is optional, this provides smaller delta updates
      - name: Rechunk with rpm-ostree
        id: rechunk
        run: |
          sudo -E $(command -v just) ostree-rechunk \
            ${IMAGE_NAME} \
            ${DEFAULT_TAG}

      # If you are feeling adventurous, use the new distro agnostic rechunker
      # https://github.com/coreos/chunkah
      # You can delete the Rechunk with rpm-ostree portion then if you use this
      #- name: Rechunk with Chunkah
      #  id: rechunk
      #  run: |
      #    sudo -E $(command -v just) rechunk \
      #      ${IMAGE_NAME} \
      #      ${DEFAULT_TAG}

      - name: Generate Build Tags
        id: gen-build-tags
        run: |
          alias_tags="$(just generate-build-tags \
                        ${IMAGE_NAME} \
                        ${DEFAULT_TAG})"

          echo "Tags for this Action..."
          echo "${alias_tags}"
          echo "alias_tags=${alias_tags}" >> $GITHUB_OUTPUT

      - name: Tag Image
        id: tag-images
        env:
          ALIAS_TAGS: ${{ steps.gen-build-tags.outputs.alias_tags }}
        run: |
          sudo -E $(command -v just) tag-images \
            "${IMAGE_NAME}" \
            "${DEFAULT_TAG}" \
            "${ALIAS_TAGS}"

      # These `if` statements are so that pull requests for your custom images do not make it publish any packages under your name without you knowing
      # They also check if the runner is on the default branch so that things like the merge queue (if you enable it), are going to work
      - name: Login to GitHub Container Registry
        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
        if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Push To GHCR
        if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
        id: push-image
        env:
          ALIAS_TAGS: ${{ steps.gen-build-tags.outputs.alias_tags }}
        run: |
          set -euox pipefail
          for tag in ${ALIAS_TAGS}; do
            sudo -E podman push --digestfile=/tmp/digestfile ${IMAGE_NAME}:${tag} ${IMAGE_REGISTRY}/${IMAGE_NAME}:${tag}
          done

          digest=$(< /tmp/digestfile)

          echo "digest=${digest}" >> $GITHUB_OUTPUT

      # This section is optional and only needs to be enabled if you plan on distributing
      # your project for others to consume. You will need to create a public and private key
      # using Cosign and save the private key as a repository secret in Github for this workflow
      # to consume. For more details, review the image signing section of the README.
      - name: Install Cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
        if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
        # https://github.com/containers/container-libs/issues/388
        with:
          cosign-release: 'v2.6.3'

      - name: Sign container image
        id: sign-image
        if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
        env:
          COSIGN_EXPERIMENTAL: false
          COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
          DIGEST: ${{ steps.push-image.outputs.digest }}
        run: |
          cosign sign -y --key env://COSIGN_PRIVATE_KEY ${IMAGE_REGISTRY}/${IMAGE_NAME}@${DIGEST}