build-clang-image.yaml

name: Build Clang Image

on:
  push:
    branches:
      - main
      - v*
    paths:
      - 'Dockerfile.clang'
  pull_request:
    paths:
      - 'Dockerfile.clang'
      - '.github/workflows/build-clang-image.yaml'

jobs:
  build-preview:
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-22.04
    steps:
      # https://github.com/docker/setup-qemu-action
      - name: Set up QEMU
        uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3.2.0
        with:
          platforms: amd64,arm64

      # https://github.com/docker/setup-buildx-action
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@988b5a0280414f521da01fcc63a27aeeb4b104db # v3.6.1

      - name: Getting image tag
        id: tag
        run: |
          if [ ${{ github.event.pull_request.head.sha }} != "" ]; then
            echo "tag=${{ github.event.pull_request.head.sha }}" >> $GITHUB_OUTPUT
          else
            echo "tag=${{ github.sha }}" >> $GITHUB_OUTPUT
          fi

      - name: Checkout source code
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        with:
          persist-credentials: false
          fetch-depth: 0

      - name: Preview build Clang image
        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5.4.0
        with:
          provenance: false
          context: .
          file: ./Dockerfile.clang
          platforms: linux/amd64,linux/arm64
          push: false
          tags: |
            quay.io/${{ github.repository_owner }}/clang:${{ steps.tag.outputs.tag }}

  build-and-push:
    if: github.event_name == 'push'
    runs-on: ubuntu-22.04
    environment: release-clang
    permissions:
      # To be able to access the repository with `actions/checkout`
      contents: read
      # Required to generate OIDC tokens for `sigstore/cosign-installer` authentication
      id-token: write
    steps:
      # https://github.com/docker/setup-qemu-action
      - name: Set up QEMU
        uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3.2.0
        with:
          platforms: amd64,arm64

      # https://github.com/docker/setup-buildx-action
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@988b5a0280414f521da01fcc63a27aeeb4b104db # v3.6.1

      - name: Login to quay.io
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        with:
          registry: quay.io
          username: ${{ secrets.QUAY_CLANG_RELEASE_USERNAME }}
          password: ${{ secrets.QUAY_CLANG_RELEASE_PASSWORD }}

      - name: Getting image tag
        id: tag
        run: |
          if [ ${{ github.event.pull_request.head.sha }} != "" ]; then
            echo "tag=${{ github.event.pull_request.head.sha }}" >> $GITHUB_OUTPUT
          else
            echo "tag=${{ github.sha }}" >> $GITHUB_OUTPUT
          fi

      - name: Checkout Source Code
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        with:
          persist-credentials: false
          fetch-depth: 0

      - name: Release Build clang
        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5.4.0
        id: docker_build_release
        with:
          provenance: false
          context: .
          file: ./Dockerfile.clang
          platforms: linux/amd64,linux/arm64
          push: true
          tags: |
            quay.io/${{ github.repository_owner }}/clang:${{ steps.tag.outputs.tag }}

      - name: Install Cosign
        uses: sigstore/cosign-installer@11086d25041f77fe8fe7b9ea4e48e3b9192b8f19 # v3.1.2

      - name: Sign Container Image
        if: steps.tag-in-repositories.outputs.exists == 'false'
        env:
          COSIGN_EXPERIMENTAL: "true"
        run: |
          cosign sign -y quay.io/${{ github.repository_owner }}/clang@${{ steps.docker_build_release.outputs.digest }}

      - name: Install Go
        uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
        with:
          # renovate: datasource=golang-version depName=go
          go-version: '1.23.3'

      - name: Install Bom
        shell: bash
        env:
          # renovate: datasource=github-releases depName=kubernetes-sigs/bom
          BOM_VERSION: v0.6.0
        run: |
          go install sigs.k8s.io/bom/cmd/bom@${{ env.BOM_VERSION }}

      - name: Generate SBOM
        shell: bash
        # To-Do: Format SBOM output to JSON after a new version of cosign is released after v1.13.1. Ref: https://github.com/sigstore/cosign/pull/2479
        run: |
          bom generate -o sbom_clang_${{ steps.tag.outputs.tag }}.spdx \
          --dirs= . \
          --image=quay.io/${{ github.repository_owner }}/clang:${{ steps.tag.outputs.tag }}

      - name: Attach SBOM to container image
        run: |
          cosign attach sbom --sbom sbom_clang_${{ steps.tag.outputs.tag }}.spdx quay.io/${{ github.repository_owner }}/clang@${{ steps.docker_build_release.outputs.digest }}

      - name: Sign SBOM Image
        if: steps.tag-in-repositories.outputs.exists == 'false'
        env:
          COSIGN_EXPERIMENTAL: "true"
        run: |
          docker_build_release_digest="${{ steps.docker_build_release.outputs.digest }}"
          image_name="quay.io/${{ github.repository_owner }}/clang:${docker_build_release_digest/:/-}.sbom"
          docker_build_release_sbom_digest="sha256:$(docker buildx imagetools inspect --raw ${image_name} | sha256sum | head -c 64)"
          cosign sign -y "quay.io/${{ github.repository_owner }}/clang@${docker_build_release_sbom_digest}"

      - name: Image Release Digest
        shell: bash
        run: |
          mkdir -p image-digest/
          job_name=clang
          job_name_capital=${job_name^^}
          job_name_underscored=${job_name_capital//-/_}
          echo "${job_name_underscored}_DIGEST := \"${{ steps.docker_build_release.outputs.digest }}\"" > image-digest/makefile-digest.txt
          echo "### clang" > image-digest/clang.txt
          echo "" >> image-digest/clang.txt
          echo "\`quay.io/${{ github.repository_owner }}/clang:${{ steps.tag.outputs.tag }}@${{ steps.docker_build_release.outputs.digest }}\`" >> image-digest/clang.txt
          echo "" >> image-digest/clang.txt

      # Upload artifact digests
      - name: Upload artifact digests
        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
        with:
          name: image-digest clang
          path: image-digest
          retention-days: 1

  image-digests:
    if: github.event_name == 'push' && github.repository == 'cilium/tetragon'
    needs: build-and-push
    name: Display Digests
    runs-on: ubuntu-22.04
    steps:
      - name: Downloading Image Digests
        shell: bash
        run: |
          mkdir -p image-digest/

      - name: Download digests of all images built
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
        with:
          path: image-digest/

      - name: Image Digests Output
        shell: bash
        run: |
          cd image-digest/
          find -type f | sort | xargs -d '\n' cat