From afea2d3577390383d1c13c81e93737c9f74d7d0d Mon Sep 17 00:00:00 2001
From: batvin3211 <104458965+batvin3211@users.noreply.github.com>
Date: Wed, 18 Sep 2024 20:59:48 +0000
Subject: [PATCH] Update build.yml

---
 .github/workflows/build.yml | 253 ++++++++++++++++++++++++++++++++++++
 1 file changed, 253 insertions(+)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 3a979f3..015b398 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -1,4 +1,254 @@
 ---
+name: BlueOS Build Action
+description: Builds container images for BlueOS
+author: JasonN3
+inputs:
+  image_name:
+    description: name of the image to build
+    required: true
+  image_variant:
+    description: name of the image variant
+    required: false
+    default: ''
+  version:
+    description: primary tag to assign to the image
+    required: true
+  support:
+    description: latest, gts, or empty
+    required: false
+    default: ''
+  extra_build_args:
+    description: extra args to be passed to buildah
+    required: false
+    default: ''
+  signing_key:
+    description: key to sign images
+    required: true
+  #TODO: Split Containerfiles
+  target:
+    description: target to build in Containerfile
+    required: false
+    default: none
+  container_registry:
+    description: registry to store resulting container
+    required: false
+    default: ghcr.io/${{ github.repository_owner }}
+  container_repo:
+    description: repository for the container image
+    required: false
+    default: ${{ github.repository }}
+  container_ref:
+    description: repository ref for the container image
+    required: false
+    default: ${{ github.ref }}
+  push_container:
+    description: whether to push the resulting container image
+    required: false
+    default: "true"
+
+runs:
+  using: "composite"
+  steps:
+    - name: Checkout
+      uses: actions/checkout@v4
+      with:
+        repository: ${{ inputs.container_repo }}
+        ref: ${{ inputs.container_ref }}
+        submodules: recursive
+
+    - name: Free disk space (Ubuntu)
+      uses: jlumbroso/free-disk-space@v1.3.1
+      with:
+        # this might remove tools that are actually needed,
+        # if set to "true" but frees about 6 GB
+        tool-cache: false
+        
+        # all of these default to true, but feel free to set to
+        # "false" if necessary for your workflow
+        android: true
+        dotnet: true
+        haskell: true
+        large-packages: true
+        docker-images: true
+        swap-storage: true
+
+    - name: Generate image name
+      id: generate-name
+      shell: bash
+      run: |
+        if [[ "${{ inputs.image_variant }}" == "main" ]]
+        then
+          echo "image_name=${{ inputs.image_name }}" >> $GITHUB_OUTPUT
+        elif [[ "${{ inputs.image_variant }}" =~ "main-*" ]]
+        then
+          variant=${{ inputs.image_variant }}
+          echo "image_name=${{ inputs.image_name }}-${variant:5}" >> $GITHUB_OUTPUT
+        else
+          echo "image_name=${{ format('{0}-{1}', inputs.image_name, inputs.image_variant) }}" >> $GITHUB_OUTPUT
+        fi
+
+    - name: Generate tags
+      id: generate-tags
+      shell: bash
+      run: |
+        # Run on main
+        if [[ ${{ github.event_name }} != 'pull_request' && ${{ github.ref_name }} == ${{ github.event.repository.default_branch }} ]]
+        then
+          BUILD_TAG="${{ inputs.version }}"
+          COMMIT_TAGS=()
+          COMMIT_TAGS+=("${{ inputs.version }}")
+          if [[ -n "${{ inputs.support }}" ]]
+          then
+            COMMIT_TAGS+=("${{ inputs.support }}")
+          fi
+          # VERSION-YYYYMMDD
+          TIMESTAMP="$(date +%Y%m%d)"
+          COMMIT_TAGS+=("${BUILD_TAG}-${TIMESTAMP}")
+        fi
+
+        # Pull Request
+        if [[ ${{ github.event_name }} == "pull_request" ]]
+        then
+          # pr-#-VERSION
+          BUILD_TAG="pr-${{ github.event.number }}-${{ inputs.version }}"
+          COMMIT_TAGS=()
+          # pr-#-VERSION-SHA
+          SHA_SHORT="${GITHUB_SHA::7}"
+          COMMIT_TAGS+=("$BUILD_TAG-${SHA_SHORT}")
+          # pr-#-VERSION-YYYYMMDD
+          TIMESTAMP="$(date +%Y%m%d)"
+          COMMIT_TAGS+=("${BUILD_TAG}-${TIMESTAMP}")
+        fi
+
+        # Other
+        if [[ -z ${BUILD_TAG} ]]
+        then
+          SHA_SHORT="${GITHUB_SHA::7}"
+          BUILD_TAG="${SHA_SHORT}"
+        fi
+
+        echo "tags=${BUILD_TAG} ${COMMIT_TAGS[*]}" >> $GITHUB_OUTPUT
+
+    # Build metadata
+    - name: Image Metadata
+      uses: docker/metadata-action@v5
+      id: meta
+      with:
+        images: |
+          ${{ steps.generate-name.outputs.image_name }}
+        labels: |
+          org.opencontainers.image.title=${{ steps.generate-name.outputs.image_name }}
+          org.opencontainers.image.version=${{ inputs.version }}
+          org.opencontainers.image.description=An interpretation of the Ubuntu spirit built on Fedora technology 
+          io.artifacthub.package.readme-url=https://raw.githubusercontent.com/${{ github.repository }}/main/README.md
+          io.artifacthub.package.logo-url=https://avatars.githubusercontent.com/u/120078124?s=200&v=4
+
+    - name: Determine extra args
+      id: extra-args
+      shell: bash
+      run: |
+        if [[ ${{ inputs.target }} == "none" ]]
+        then
+          echo "args=" >> $GITHUB_OUTPUT
+        else
+          echo "args=--target=${{ inputs.target }}" >> $GITHUB_OUTPUT
+        fi
+
+    # Build image using Buildah action
+    - name: Build Image
+      id: build_image
+      uses: redhat-actions/buildah-build@v2
+      with:
+        containerfiles: |
+          ./Containerfile
+        image: ${{ steps.generate-name.outputs.image_name }}
+        tags: ${{ steps.generate-tags.outputs.tags }}
+        build-args: |
+          IMAGE_NAME=${{ inputs.image_name }}
+          IMAGE_FLAVOR=${{ inputs.image_variant }}
+          IMAGE_VENDOR=${{ github.repository_owner }}
+          FEDORA_MAJOR_VERSION=${{ inputs.version }}
+          TARGET_BASE=${{ inputs.image_variant }}
+          ${{ inputs.extra_build_args }}
+        labels: ${{ steps.meta.outputs.labels }}
+        oci: false
+        #TODO: Split Containerfiles
+        extra-args: ${{ steps.extra-args.outputs.args }}
+          
+
+    - name: Get list of images to verify
+      id: images_to_verify
+      shell: bash
+      run: |
+        # grep may return 1 if no ublue images were used
+        set +o pipefail
+        ublue_images=$(buildah images | tail -n +2 | grep -v localhost | awk '{print $1}' | grep '^ghcr.io/ublue-os' | tr '\n' ' ')
+        chainguard_images=$(buildah images | tail -n +2 | grep -v localhost | awk '{print $1}' | grep '^cgr.dev/chainguard' | tr '\n' ' ')
+
+        echo "ublue_images=${ublue_images}" >> $GITHUB_OUTPUT
+        echo "chainguard_images=${chainguard_images}" >> $GITHUB_OUTPUT
+
+    - name: Verify base image
+      if: ${{ steps.images_to_verify.output.ublue_images }} != ''
+      uses: EyeCantCU/cosign-action/verify@v0.2.2
+      with:
+        containers: ${{ steps.images_to_verify.output.ublue_images }}
+        pubkey: https://raw.githubusercontent.com/ublue-os/main/main/cosign.pub
+    
+    - name: Verify chainguard images
+      if: ${{ steps.images_to_verify.output.chainguard_images }} != ''
+      uses: EyeCantCU/cosign-action/verify@v0.2.2
+      with:
+        containers: ${{ steps.images_to_verify.output.chainguard_images }}
+        cert-identity: https://github.com/chainguard-images/images/.github/workflows/release.yaml@refs/heads/main
+        oidc-issuer: https://token.actions.githubusercontent.com
+        registry: cgr.dev/chainguard
+
+    # Workaround bug where capital letters in your GitHub username make it impossible to push to GHCR.
+    # https://github.com/macbre/push-to-ghcr/issues/12
+    - name: Lowercase Registry
+      id: registry_case
+      uses: ASzc/change-string-case-action@v6
+      with:
+        string: ${{ inputs.container_registry }}
+
+    # Push the image to GHCR (Image Registry)
+    - name: Push To GHCR
+      id: push
+      if: inputs.push_container == 'true'
+      env:
+        REGISTRY_USER: ${{ github.actor }}
+        REGISTRY_PASSWORD: ${{ github.token }}
+      uses: redhat-actions/push-to-registry@v2
+      with:
+        image: ${{ steps.build_image.outputs.image }}
+        tags: ${{ steps.generate-tags.outputs.tags }}
+        registry: ${{ steps.registry_case.outputs.lowercase }}
+        username: ${{ env.REGISTRY_USER }}
+        password: ${{ env.REGISTRY_PASSWORD }}
+
+    - name: Login to GitHub Container Registry
+      uses: docker/login-action@v3
+      if: inputs.push_container == 'true' && github.event_name == 'push' && github.ref == github.event.repository.default_branch
+      with:
+        registry: ghcr.io
+        username: ${{ github.actor }}
+        password: ${{ github.token }}
+
+    # Sign container
+    - uses: sigstore/cosign-installer@v3.4.0
+      if: inputs.push_container == 'true' && github.event_name == 'push' && github.ref == github.event.repository.default_branch
+
+    - name: Sign container image
+      shell: bash
+      if: inputs.push_container == 'true' && github.event_name == 'push' && github.ref == github.event.repository.default_branch
+      run: |
+        cosign sign -y --key env://COSIGN_PRIVATE_KEY ${{ steps.registry_case.outputs.lowercase }}/${{ steps.build_image.outputs.image }}@${TAGS}
+      env:
+        TAGS: ${{ steps.push.outputs.digest }}
+        COSIGN_EXPERIMENTAL: "false"
+        COSIGN_PRIVATE_KEY: ${{ inputs.signing_key }}
+        
 name: build-ublue-custom
 on:
   pull_request:
@@ -151,3 +401,6 @@ jobs:
           TAGS: ${{ steps.push.outputs.digest }}
           COSIGN_EXPERIMENTAL: false
           COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
+
+
+