reusable_build_image.yaml

---
on:
  workflow_call:
    inputs:
      product-name:
        description: The boil product directory name (e.g. "hadoop" or "precompiled/hadoop")
        required: true
        type: string
      image-name:
        description: |
          The image name used in the OCI registry. Defaults to product-name if not set.
          This is used when the boil directory is nested (eg: precompiled/hadoop) but
          the parent directory will be used as the namespace (eg: precompiled).
        default: ""
        type: string
      sdp-version:
        required: true
        type: string
      registry-namespace:
        required: true
        type: string
      runners:
        description: |
          The type of runners used.
          - `mixed`: x86_64 builds run on the GitHub hosted runners and the aarch64 builds run on the Ubicloud runners
          - `ubicloud`: Both the x86_64 and the aarch64 builds run on the Ubicloud runners
        default: mixed
        type: string
      publish:
        description: Whether to publish and sign images.
        type: boolean
        default: true
      publish-to-quay:
        description: |
          Whether to publish to quay.io or not. If `true`, the `quay-robot-secret` needs to be
          provided.
        type: boolean
        default: true
      floating-tag:
        description: Whether to produce a floating tag
        type: boolean
        default: true
    secrets:
      harbor-robot-secret:
        description: The secret for the Harbor robot user used to push images and manifest
        required: true
      quay-robot-secret:
        description: The secret for the Quay.io robot user used to push images and manifest
      slack-token:
        description: The Slack token used to post failure notifications
        required: true

permissions: {}

jobs:
  generate_runner_dimension:
    name: Generate Runner Dimension
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - id: runners
        shell: bash
        env:
          RUNNERS_TYPE: ${{ inputs.runners }}
        run: |
          if [ "$RUNNERS_TYPE" == "mixed" ]; then
            RUNNERS=$(jq --compact-output < .github/workflows/runners/mixed.json)
            echo "RUNNERS=$RUNNERS" | tee -a "$GITHUB_OUTPUT"
          elif [ "$RUNNERS_TYPE" == "ubicloud" ]; then
            RUNNERS=$(jq --compact-output < .github/workflows/runners/ubicloud.json)
            echo "RUNNERS=$RUNNERS" | tee -a "$GITHUB_OUTPUT"
          else
            echo "Invalid runners type, expected 'mixed' or 'ubicloud'"
            exit 1
          fi
    outputs:
      runners: ${{ steps.runners.outputs.RUNNERS }}

  generate_version_dimension:
    name: Generate Version Dimension
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - id: shard
        uses: stackabletech/actions/shard@d5c85b3cef351617f19de803812b42b839e20168 # v0.18.4
        with:
          product-name: ${{ inputs.product-name }}
    outputs:
      versions: ${{ steps.shard.outputs.versions }}

  build:
    name: Build/Publish ${{ matrix.versions }}-${{ matrix.runner.arch }} Image
    needs:
      - generate_version_dimension
      - generate_runner_dimension
    permissions:
      id-token: write
      contents: read
    runs-on: ${{ matrix.runner.name }}
    strategy:
      fail-fast: false
      matrix:
        versions: ${{ fromJson(needs.generate_version_dimension.outputs.versions) }}
        runner: ${{ fromJson(needs.generate_runner_dimension.outputs.runners) }}
    steps:
      - name: Checkout Repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Free Disk Space
        uses: stackabletech/actions/free-disk-space@d5c85b3cef351617f19de803812b42b839e20168 # v0.18.4

      - name: Build Product Image
        id: build
        uses: stackabletech/actions/build-product-image@d5c85b3cef351617f19de803812b42b839e20168 # v0.18.4
        with:
          registry-namespace: ${{ inputs.registry-namespace }}
          product-name: ${{ inputs.product-name }}
          product-version: ${{ matrix.versions }}
          sdp-version: ${{ inputs.sdp-version }}
          # Map the boolean to a string, because actions cannot use boolean inputs.
          floating-tag: ${{ case(inputs.floating-tag, 'true', 'false') }}

      - name: Publish Container Image on oci.stackable.tech
        if: inputs.publish
        uses: stackabletech/actions/publish-image@d5c85b3cef351617f19de803812b42b839e20168 # v0.18.4
        with:
          image-registry-uri: oci.stackable.tech
          image-registry-username: robot$${{ inputs.registry-namespace }}+github-action-build
          image-registry-password: ${{ secrets.harbor-robot-secret }}
          # NOTE (@NickLarsenNZ): This fallback is just for now so we can support both repo level
          # image folders that go under the sdp namespace AND nested image folders that contain the
          # namespace (for example precommit/hadoop).
          # In future, we probably want to encode this information in the boil config metadata per
          # registry so we don't have to do such gymnastics in the workflow.
          image-repository: ${{ inputs.registry-namespace }}/${{ inputs.image-name || inputs.product-name }}
          canonical-image-manifest-tag: ${{ steps.build.outputs.canonical-image-manifest-tag }}
          canonical-source-image-uri: localhost/${{ inputs.registry-namespace }}/${{ inputs.product-name }}:${{ steps.build.outputs.canonical-image-manifest-tag }}
          other-image-manifest-tags: ${{ steps.build.outputs.other-image-manifest-tags }}

      - name: Publish Container Image on quay.io
        if: inputs.publish && inputs.publish-to-quay
        uses: stackabletech/actions/publish-image@d5c85b3cef351617f19de803812b42b839e20168 # v0.18.4
        with:
          image-registry-uri: quay.io
          image-registry-username: stackable+robot_${{ inputs.registry-namespace }}_github_action_build
          image-registry-password: ${{ secrets.quay-robot-secret }}
          # NOTE (@NickLarsenNZ): This fallback is just for now so we can support both repo level
          # image folders that go under the sdp namespace AND nested image folders that contain the
          # namespace (for example precommit/hadoop).
          # In future, we probably want to encode this information in the boil config metadata per
          # registry so we don't have to do such gymnastics in the workflow.
          image-repository: stackable/${{ inputs.registry-namespace }}/${{ inputs.image-name || inputs.product-name }}
          canonical-image-manifest-tag: ${{ steps.build.outputs.canonical-image-manifest-tag }}
          canonical-source-image-uri: localhost/${{ inputs.registry-namespace }}/${{ inputs.product-name }}:${{ steps.build.outputs.canonical-image-manifest-tag }}
          other-image-manifest-tags: ${{ steps.build.outputs.other-image-manifest-tags }}

  publish_manifests:
    name: Build/Publish ${{ matrix.versions }} Manifests
    needs: [generate_version_dimension, build]
    permissions:
      id-token: write
      contents: read
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        versions: ${{ fromJson(needs.generate_version_dimension.outputs.versions) }}
    steps:
      - name: Checkout Repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      # NOTE (@Techassi): I'm not super happy about how this looks/works, but as already mentioned,
      # this should only be a stepping stone towards a more robust solution.
      - name: Install boil
        if: inputs.floating-tag
        uses: stackabletech/actions/setup-tools@d5c85b3cef351617f19de803812b42b839e20168 # v0.18.4
        with:
          boil-version: latest

      - name: Extract floating image index manifest tag
        id: extract-floating-tag
        if: inputs.floating-tag
        env:
          SDP_VERSION: ${{ inputs.sdp-version }}
          IMAGE_VERSION: ${{ matrix.versions }}
        shell: bash
        run: |
          set -euo pipefail

          FLOATING_IMAGE_INDEX_MANIFEST_TAG=$(boil tools floating-tag "${SDP_VERSION}")
          FLOATING_IMAGE_INDEX_MANIFEST_TAG="${IMAGE_VERSION}-stackable${FLOATING_IMAGE_INDEX_MANIFEST_TAG}"

          echo "FLOATING_IMAGE_INDEX_MANIFEST_TAG=[\"$FLOATING_IMAGE_INDEX_MANIFEST_TAG\"]" | tee -a "$GITHUB_OUTPUT"

      - name: Publish and Sign Image Index Manifest to oci.stackable.tech
        id: publish-oci
        if: inputs.publish
        uses: stackabletech/actions/publish-image-index-manifest@d5c85b3cef351617f19de803812b42b839e20168 # v0.18.4
        with:
          image-registry-uri: oci.stackable.tech
          image-registry-username: robot$${{ inputs.registry-namespace }}+github-action-build
          image-registry-password: ${{ secrets.harbor-robot-secret }}
          # NOTE (@NickLarsenNZ): This fallback is just for now so we can support both repo level
          # image folders that go under the sdp namespace AND nested image folders that contain the
          # namespace (for example precommit/hadoop).
          # In future, we probably want to encode this information in the boil config metadata per
          # registry so we don't have to do such gymnastics in the workflow.
          image-repository: ${{ inputs.registry-namespace }}/${{ inputs.image-name || inputs.product-name }}
          canonical-image-index-manifest-tag: ${{ matrix.versions }}-stackable${{ inputs.sdp-version }}
          other-image-index-manifest-tags: ${{ case(inputs.floating-tag, steps.extract-floating-tag.outputs.FLOATING_IMAGE_INDEX_MANIFEST_TAG, '[]') }}

      - name: Publish and Sign Image Index Manifest to quay.io
        id: publish-quay
        if: inputs.publish && inputs.publish-to-quay
        uses: stackabletech/actions/publish-image-index-manifest@d5c85b3cef351617f19de803812b42b839e20168 # v0.18.4
        with:
          image-registry-uri: quay.io
          image-registry-username: stackable+robot_${{ inputs.registry-namespace }}_github_action_build
          image-registry-password: ${{ secrets.quay-robot-secret }}
          # NOTE (@NickLarsenNZ): This fallback is just for now so we can support both repo level
          # image folders that go under the sdp namespace AND nested image folders that contain the
          # namespace (for example precommit/hadoop).
          # In future, we probably want to encode this information in the boil config metadata per
          # registry so we don't have to do such gymnastics in the workflow.
          image-repository: stackable/${{ inputs.registry-namespace }}/${{ inputs.image-name || inputs.product-name }}
          canonical-image-index-manifest-tag: ${{ matrix.versions }}-stackable${{ inputs.sdp-version }}
          other-image-index-manifest-tags: ${{ case(inputs.floating-tag, steps.extract-floating-tag.outputs.FLOATING_IMAGE_INDEX_MANIFEST_TAG, '[]') }}

  notify:
    name: Failure Notification
    needs: [generate_version_dimension, build, publish_manifests]
    runs-on: ubuntu-latest
    # TODO (@NickLarsenNZ): Allow a condition from input so that we can always
    # be notified of new builds for precompiled product images.
    if: failure() || (github.run_attempt > 1 && !cancelled())
    steps:
      - name: Send Notification
        uses: stackabletech/actions/send-slack-notification@d5c85b3cef351617f19de803812b42b839e20168 # v0.18.4
        with:
          publish-manifests-result: ${{ needs.publish_manifests.result }}
          build-result: ${{ needs.build.result }}
          slack-token: ${{ secrets.slack-token }}
          channel-id: C07UG6JH44F # notifications-container-images
          type: container-image-build