build.yaml

# This is a placeholder workflow and will be replaced once the appropriate
# functionality passes code review.
#
# Dispatching workflow calls to a GHA workflow on a branch requires that a
# workflow file with the correct name exists in the default branch, even
# if that workflow bears no resemblance to the target workflow

name: Build FPM Images
on:
  workflow_dispatch:
    inputs:
      version:
        description: The version to use in the image label
        required: true
        type: string
  push:
    tags: [ '*' ]

jobs:
  build:
    strategy:
      matrix:
        include:
          - directory: centos/8
            label: centos8
          - directory: debian/12
            label: debian12
    runs-on: ubuntu-latest
    permissions:
      id-token: write  # required for aws-actions/configure-aws-credentials
      contents: read
    steps:
      - name: version
        env:
          VERSION: ${{ inputs.version }}
          REF_NAME: ${{ github.ref_name }}
        run: |
          V="${VERSION:-${REF_NAME}}"
          if [[ -z "$V" ]]; then
            echo "No version or ref_name set" >&2
            exit 1
          fi
          echo "V=$V" >> "$GITHUB_ENV"
      - name: Assume AWS ECR Push Role
        uses: aws-actions/configure-aws-credentials@010d0da01d0b5a38af31e9c3470dbfdabdecca3a # v4.0.1
        with:
          aws-region: us-west-2
          role-to-assume: arn:aws:iam::146628656107:role/fpm-oci-tag-build-gha
          role-session-name: "gha-fpm-build=${{ github.run_number }}"
          role-duration-seconds: 900
      - name: Log into ECR
        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
        with:
          registry: public.ecr.aws
        env:
          AWS_REGION: us-east-1
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Build FPM Image
        uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0
        with:
          push: true
          context: ${{ matrix.directory }}
          file: ${{ matrix.directory }}/Dockerfile
          platforms: linux/amd64,linux/arm64
          tags: |
            public.ecr.aws/gravitational/fpm:${{ matrix.label }}-${{ env.V }}