vaccel-build-and-upload.yml

name: Build QEMU+vAccel docker image

on:
  push:
    branches: [ '*+vaccel' ]

  workflow_dispatch:

env:
  REGISTRY: harbor.nbfc.io/nubificus
  IMAGE_NAME: qemu-vaccel
  APP: qemu-vaccel

jobs:
  build:
    name: Build Docker Image
    runs-on: [self-hosted, gcc, lite, "${{ matrix.arch }}"]
    strategy:
      matrix:
        #arch: [x86_64, aarch64]
        arch: [x86_64]
    outputs:
      hash: ${{ steps.build-and-push.outputs.digest }}
      tags: ${{ steps.meta.outputs.tags }}
    permissions:
      contents: read
      id-token: write

    steps:
    - name: Cleanup previous jobs
      run: |
        echo "Cleaning up previous runs"
        sudo rm -rf ${{ github.workspace }}/*
        sudo rm -rf ${{ github.workspace }}/.??*

    - name: Checkout code
      uses: actions/checkout@v4

    - name: Log into registry ${{ env.REGISTRY }}
      uses: docker/login-action@v3
      with:
        registry: ${{ env.REGISTRY }}
        username: ${{ secrets.HARBOR_USER }}
        password: ${{ secrets.HARBOR_SECRET }}

    - name: Extract Docker metadata
      id: meta
      #uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38
      uses: docker/metadata-action@v5
      with:
        images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}

    - name: Build and push Docker image
      id: build-and-push
      #uses: docker/build-push-action@ad44023a93711e3deb337508980b4b5e9bcdc5dc
      uses: docker/build-push-action@v6
      with:
        context: .
        file: subprojects/vaccel/Dockerfile
        no-cache: true
        push: true
        tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ matrix.arch }}
        labels: ${{ steps.meta.outputs.labels }}
        build-args: |
          ARCHTAG=${{ matrix.arch }}
          BRANCH=${{ github.event.ref_name | github.ref_name }}

  sign:
    name: Sign Docker Image
    runs-on: [self-hosted]
    needs: [build]

    steps:
    - name: Install Cosign
      uses: sigstore/cosign-installer@v3.4.0

    - name: Check install
      run: cosign version

    - name: Login to Harbor
      uses: docker/login-action@v3
      with:
        registry: harbor.nbfc.io/nubificus
        username: ${{ secrets.harbor_user }}
        password: ${{ secrets.harbor_secret }}

    - name: Sign published Docker image
      env:
        COSIGN_EXPERIMENTAL: "true"
        DIGEST: ${{ needs.build.outputs.hash }}
        TAGS: ${{ needs.build.outputs.tags }}
      run: |
        cosign sign --yes harbor.nbfc.io/nubificus/${{ env.APP }}@${{ env.DIGEST }} \
        -a "repo=${{ github.repository }}" \
        -a "workflow=${{ github.workflow }}" \
        -a "ref=${{ github.sha }}" \
        -a "author=Nubificus LTD"
    - name: Cleanup previous runs
      if: ${{ always() }}
      run: |
        sudo rm -rf ${{ github.workspace }}/*
        sudo rm -rf ${{ github.workspace }}/.??*