kaniko/.github/workflows/images.yaml

name: Build images

on:
  pull_request:
    branches: ['main']
  push:
    branches: ['main']
    tags: ['v[0-9]+.[0-9]+.[0-9]+*']

jobs:
  build-images:
    concurrency:
      # If a previous run is ongoing with the same head_ref (it's a run on the
      # same PR) then cancel it to save time. If it isn't a PR, only cancel the
      # previous run if it's on the same commit SHA. This prevents a run for a
      # commit push from cancelling a previous commit push's build, since we
      # want an image built and tagged for each commit.
      group: build-images-${{ matrix.image }}-${{ github.head_ref || github.sha }}
      cancel-in-progress: true
    permissions:
      contents: read  # Read the repo contents.
      id-token: write # Produce identity token for keyless signing.
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        image:
        - executor
        - executor-debug
        - executor-slim
        - warmer

        include:
        - image: executor
          dockerfile: ./deploy/Dockerfile
          platforms: linux/amd64,linux/arm64,linux/s390x,linux/ppc64le
          image-name: gcr.io/kaniko-project/executor
          tag: ${{ github.sha }}
          release-tag: latest

        - image: executor-debug
          dockerfile: ./deploy/Dockerfile_debug
          platforms: linux/amd64,linux/arm64,linux/s390x
          image-name: gcr.io/kaniko-project/executor
          tag: ${{ github.sha }}-debug
          release_tag: debug

        - image: executor-slim
          dockerfile: ./deploy/Dockerfile_slim
          platforms: linux/amd64,linux/arm64,linux/s390x,linux/ppc64le
          image-name: gcr.io/kaniko-project/executor
          tag: ${{ github.sha }}-slim
          release-tag: slim

        - image: warmer
          dockerfile: ./deploy/Dockerfile_warmer
          platforms: linux/amd64,linux/arm64,linux/s390x,linux/ppc64le
          image-name: gcr.io/kaniko-project/warmer
          tag: ${{ github.sha }}
          release-tag: latest

    steps:
    - uses: actions/checkout@b0e28b5ac45a892f91e7d036f8200cf5ed489415 # v3

    # Setup auth if not a PR.
    - if: github.event_name != 'pull_request'
      uses: google-github-actions/setup-gcloud@04141d8a7edfc8c679682f23e7bbbe05cbe32bb3 # v0.5.1
      with:
        service_account_key: ${{ secrets.GCR_DEVOPS_SERVICE_ACCOUNT_KEY }}
        project_id: kaniko-project
        export_default_credentials: true
    - if: github.event_name != 'pull_request'
      run: gcloud auth configure-docker

    # Build and push with Docker.
    - uses: docker/setup-qemu-action@27d0a4f181a40b142cce983c5393082c365d1480 # v1
      with:
        platforms: ${{ matrix.platforms }}
    - uses: docker/setup-buildx-action@94ab11c41e45d028884a99163086648e898eed25 # v1
    - uses: docker/build-push-action@7f9d37fa544684fb73bfe4835ed7214c255ce02b # v2
      id: build-and-push
      with:
        context: .
        file: ${{ matrix.dockerfile }}
        platforms: ${{ matrix.platforms }}
        push: ${{ github.event_name != 'pull_request' }} # Only push if not a PR.
        tags: ${{ matrix.image-name }}:${{ matrix.tag }}
        # https://github.com/docker/build-push-action/blob/master/docs/advanced/cache.md#github-cache
        cache-from: type=gha
        cache-to: type=gha,mode=max

    # Sign images if not a PR.
    - if: github.event_name != 'pull_request'
      uses: sigstore/cosign-installer@b4f55743d10d066fee1de1cf0fa26069700c0195 # main
      with:
        cosign-release: 'v1.4.1'
    - if: github.event_name != 'pull_request'
      env:
        COSIGN_EXPERIMENTAL: "true"
      run: |
        cosign sign \
            --key gcpkms://projects/kaniko-project/locations/global/keyRings/cosign/cryptoKeys/cosign \
            ${{ matrix.image-name }}@${{ steps.build-and-push.outputs.digest }}
        cosign sign ${{ matrix.image-name }}@${{ steps.build-and-push.outputs.digest }}

    # If a tag push, use crane to add more tags.
    - if: startsWith(github.ref, 'refs/tags/v')
      uses: imjasonh/setup-crane@5146f708a817ea23476677995bf2133943b9be0b # v0.1
    - if: startsWith(github.ref, 'refs/tags/v')
      name: Apply release tags
      run: |
        crane cp ${{ matrix.image-name }}@${{ steps.build-and-push.outputs.digest }} \
            ${{ matrix.image-name }}:${GITHUB_REF/refs\/tags\//}
        crane cp ${{ matrix.image-name }}@${{ steps.build-and-push.outputs.digest }} \
            ${{ matrix.image-name }}:${{ matrix.release-tag }}