build.yml

name: build-bonito
on:
  push:
    branches:
      - main
    paths-ignore:
      - '**.md'
      - '**.txt'
  schedule:
    - cron: '0 5 * * *'  # 5am UTC everyday (timed against official fedora container pushes)
  workflow_dispatch:
env:
  SOURCE_IMAGE_REGISTRY: quay.io/fedora-ostree-desktops
  TARGET_IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }}

jobs:
  build_bonito:
    name: Build and push image
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      packages: write
      id-token: write
    strategy:
      fail-fast: false
      matrix:
        source_image_name:
          - sway-atomic
          - kinoite
        fedora_version: [41]
        include:
          - fedora_version: 41
            is_current_version: true
          - source_image_name: sway-atomic
            target_image_name: bonito-sway
          - source_image_name: kinoite
            target_image_name: bonito-kde
    steps:
      # Checkout push-to-registry action github repository
      - name: Checkout Push to Registry action
        uses: actions/checkout@v4

      - name: Generate path to base image's repository
        id: base-image
        run: |
          echo "path=${{ env.SOURCE_IMAGE_REGISTRY }}/${{ matrix.source_image_name }}" >> $GITHUB_OUTPUT

      - name: Generate tags
        id: generate-tags
        shell: bash
        run: |
          # Generate a timestamp for creating an image version history
          TIMESTAMP="$(date +%Y%m%d)"
          MAJOR_VERSION="${{ matrix.fedora_version }}"
          BUILD_TAGS=("${MAJOR_VERSION}" "${MAJOR_VERSION}-${TIMESTAMP}")

          if [[ "${{ matrix.is_current_version }}" == "true" ]]; then
              BUILD_TAGS+=("latest")
          fi

          echo "Generated the following build tags: "
          for TAG in "${BUILD_TAGS[@]}"; do
              echo "${TAG}"
          done

          echo "tags=${BUILD_TAGS[*]}" >> $GITHUB_OUTPUT

      - name: Get base image version
        id: labels
        uses: Wandalen/wretry.action@v3.7.3
        with:
          attempt_limit: 3
          attempt_delay: 15000
          command: |
            set -eo pipefail
            ver=$(skopeo inspect docker://${{ steps.base-image.outputs.path }}:${{ matrix.fedora_version }} | jq -r '.Labels["org.opencontainers.image.version"]')
            if [ -z "$ver" ] || [ "null" = "$ver" ]; then
              echo "inspected image version must not be empty or null"
              exit 1
            fi
            echo "base_image_version=$ver" >> $GITHUB_OUTPUT

      - name: Pull base image
        uses: Wandalen/wretry.action@v3.7.3
        with:
          attempt_limit: 3
          attempt_delay: 15000
          command: |
            # pull the base image used for FROM in containerfile so
            # we can retry on that unfortunately common failure case
            podman pull ${{ steps.base-image.outputs.path }}:${{ matrix.fedora_version }}

      # Generate image metadata
      - name: Image Metadata
        uses: docker/metadata-action@v5
        id: meta
        with:
          images: |
            ${{ matrix.target_image_name }}
          labels: |
            org.opencontainers.image.title=${{ matrix.target_image_name }}
            org.opencontainers.image.version=${{ steps.labels.outputs.outputs && fromJSON(steps.labels.outputs.outputs).base_image_version }}
            org.opencontainers.image.description=A Universal Blue ${{ matrix.target_image_name }} image customized by ryanpz
            io.artifacthub.package.readme-url=https://raw.githubusercontent.com/${{ github.repository }}/main/README.md
            io.artifacthub.package.logo-url=https://avatars.githubusercontent.com/u/23235374?v=4

      # Build image using Buildah action
      - name: Build Image
        id: build-image
        uses: redhat-actions/buildah-build@v2
        with:
          containerfiles: |
            ./Containerfile
          image: ${{ matrix.target_image_name }}
          tags: |
            ${{ steps.generate-tags.outputs.tags }}
          build-args: |
            SOURCE_IMAGE_NAME=${{ matrix.source_image_name }}
            SOURCE_IMAGE_TAG=${{ matrix.fedora_version }}
            SOURCE_IMAGE=${{ steps.base-image.outputs.path }}
          labels: ${{ steps.meta.outputs.labels }}
          oci: false

      - name: Push To GHCR
        uses: Wandalen/wretry.action@v3.7.3
        id: push
        env:
          REGISTRY_USER: ${{ github.actor }}
          REGISTRY_PASSWORD: ${{ github.token }}
        with:
          action: redhat-actions/push-to-registry@v2
          attempt_limit: 3
          attempt_delay: 15000
          with: |
            image: ${{ steps.build-image.outputs.image }}
            tags: ${{ steps.build-image.outputs.tags }}
            registry: ${{ env.TARGET_IMAGE_REGISTRY }}
            username: ${{ env.REGISTRY_USER }}
            password: ${{ env.REGISTRY_PASSWORD }}
            extra-args: |
              --disable-content-trust

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
          
      # Sign container
      - uses: sigstore/cosign-installer@v3.7.0
      
      - name: Sign container image
        run: |
          cosign sign -y --key env://COSIGN_PRIVATE_KEY ${{ env.TARGET_IMAGE_REGISTRY }}/${{ steps.build-image.outputs.image }}@${TAGS}
        env:
          TAGS: ${{ steps.push.outputs.outputs && fromJSON(steps.push.outputs.outputs).digest }}
          COSIGN_EXPERIMENTAL: false
          COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}

      - name: Echo outputs
        run: |
          echo "${{ toJSON(steps.push.outputs) }}"

  check:
    name: Check all builds successful
    if: ${{ !cancelled() }}
    runs-on: ubuntu-latest
    needs: [build_bonito]
    steps:
      - name: Exit on failure
        if: ${{ needs.build_bonito.result == 'failure' }}
        shell: bash
        run: exit 1
      - name: Exit
        shell: bash
        run: exit 0