build-clang-image.yaml

name: Build Clang Image

on:
  push:
    branches:
      - main
      - v*
    paths:
      - 'Dockerfile.clang'
  pull_request:
    paths:
      - 'Dockerfile.clang'
      - '.github/workflows/build-clang-image.yaml'

jobs:
  build-preview:
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-22.04
    steps:
      # https://github.com/docker/setup-qemu-action
      - name: Set up QEMU
        uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3.0.0
        with:
          platforms: amd64,arm64

      # https://github.com/docker/setup-buildx-action
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0

      - name: Getting image tag
        id: tag
        run: |
          if [ ${{ github.event.pull_request.head.sha }} != "" ]; then
            echo "tag=${{ github.event.pull_request.head.sha }}" >> $GITHUB_OUTPUT
          else
            echo "tag=${{ github.sha }}" >> $GITHUB_OUTPUT
          fi

      - name: Checkout source code
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
        with:
          persist-credentials: false
          fetch-depth: 0

      - name: Preview build Clang image
        uses: docker/build-push-action@4a13e500e55cf31b7a5d59a38ab2040ab0f42f56 # v5.1.0
        with:
          provenance: false
          context: .
          file: ./Dockerfile.clang
          platforms: linux/amd64,linux/arm64
          push: false
          tags: |
            quay.io/${{ github.repository_owner }}/clang:${{ steps.tag.outputs.tag }}

  build-and-push:
    if: github.event_name == 'push'
    runs-on: ubuntu-22.04
    environment: release-clang
    permissions:
      # To be able to access the repository with `actions/checkout`
      contents: read
      # Required to generate OIDC tokens for `sigstore/cosign-installer` authentication
      id-token: write
    steps:
      # https://github.com/docker/setup-qemu-action
      - name: Set up QEMU
        uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3.0.0
        with:
          platforms: amd64,arm64

      # https://github.com/docker/setup-buildx-action
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0

      - name: Login to quay.io
        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
        with:
          registry: quay.io
          username: ${{ secrets.QUAY_CLANG_RELEASE_USERNAME }}
          password: ${{ secrets.QUAY_CLANG_RELEASE_PASSWORD }}

      - name: Getting image tag
        id: tag
        run: |
          if [ ${{ github.event.pull_request.head.sha }} != "" ]; then
            echo "tag=${{ github.event.pull_request.head.sha }}" >> $GITHUB_OUTPUT
          else
            echo "tag=${{ github.sha }}" >> $GITHUB_OUTPUT
          fi

      - name: Checkout Source Code
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
        with:
          persist-credentials: false
          fetch-depth: 0

      - name: Release Build clang
        uses: docker/build-push-action@4a13e500e55cf31b7a5d59a38ab2040ab0f42f56 # v5.1.0
        id: docker_build_release
        with:
          provenance: false
          context: .
          file: ./Dockerfile.clang
          platforms: linux/amd64,linux/arm64
          push: true
          tags: |
            quay.io/${{ github.repository_owner }}/clang:${{ steps.tag.outputs.tag }}

      - name: Install Cosign
        uses: sigstore/cosign-installer@11086d25041f77fe8fe7b9ea4e48e3b9192b8f19 # v3.1.2

      - name: Sign Container Image
        if: steps.tag-in-repositories.outputs.exists == 'false'
        env:
          COSIGN_EXPERIMENTAL: "true"
        run: |
          cosign sign -y quay.io/${{ github.repository_owner }}/clang@${{ steps.docker_build_release.outputs.digest }}

      - name: Install Go
        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
        with:
          # renovate: datasource=golang-version depName=go
          go-version: '1.22.3'

      - name: Install Bom
        shell: bash
        env:
          # renovate: datasource=github-releases depName=kubernetes-sigs/bom
          BOM_VERSION: v0.6.0
        run: |
          go install sigs.k8s.io/bom/cmd/bom@${{ env.BOM_VERSION }}

      - name: Generate SBOM
        shell: bash
        # To-Do: Format SBOM output to JSON after a new version of cosign is released after v1.13.1. Ref: https://github.com/sigstore/cosign/pull/2479
        run: |
          bom generate -o sbom_clang_${{ steps.tag.outputs.tag }}.spdx \
          --dirs= . \
          --image=quay.io/${{ github.repository_owner }}/clang:${{ steps.tag.outputs.tag }}

      - name: Attach SBOM to container image
        run: |
          cosign attach sbom --sbom sbom_clang_${{ steps.tag.outputs.tag }}.spdx quay.io/${{ github.repository_owner }}/clang@${{ steps.docker_build_release.outputs.digest }}

      - name: Sign SBOM Image
        if: steps.tag-in-repositories.outputs.exists == 'false'
        env:
          COSIGN_EXPERIMENTAL: "true"
        run: |
          docker_build_release_digest="${{ steps.docker_build_release.outputs.digest }}"
          image_name="quay.io/${{ github.repository_owner }}/clang:${docker_build_release_digest/:/-}.sbom"
          docker_build_release_sbom_digest="sha256:$(docker buildx imagetools inspect --raw ${image_name} | sha256sum | head -c 64)"
          cosign sign -y "quay.io/${{ github.repository_owner }}/clang@${docker_build_release_sbom_digest}"

      - name: Image Release Digest
        shell: bash
        run: |
          mkdir -p image-digest/
          job_name=clang
          job_name_capital=${job_name^^}
          job_name_underscored=${job_name_capital//-/_}
          echo "${job_name_underscored}_DIGEST := \"${{ steps.docker_build_release.outputs.digest }}\"" > image-digest/makefile-digest.txt
          echo "### clang" > image-digest/clang.txt
          echo "" >> image-digest/clang.txt
          echo "\`quay.io/${{ github.repository_owner }}/clang:${{ steps.tag.outputs.tag }}@${{ steps.docker_build_release.outputs.digest }}\`" >> image-digest/clang.txt
          echo "" >> image-digest/clang.txt

      # Upload artifact digests
      - name: Upload artifact digests
        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
        with:
          name: image-digest clang
          path: image-digest
          retention-days: 1

  image-digests:
    if: github.event_name == 'push' && github.repository == 'cilium/tetragon'
    needs: build-and-push
    name: Display Digests
    runs-on: ubuntu-22.04
    steps:
      - name: Downloading Image Digests
        shell: bash
        run: |
          mkdir -p image-digest/

      - name: Download digests of all images built
        uses: actions/download-artifact@eaceaf801fd36c7dee90939fad912460b18a1ffe # v4.1.2
        with:
          path: image-digest/

      - name: Image Digests Output
        shell: bash
        run: |
          cd image-digest/
          find -type f | sort | xargs -d '\n' cat