security.yml

name: Image Security Updates

on:
  schedule:
    - cron: "0 4 * * 1"
  workflow_dispatch:
    inputs:
      immutable:
        type: boolean
        description: Generate stable image tags
      buildkitVersion:
        type: string
        description: Override version defined in Helm chart

jobs:
  process-input:
    name: Process input
    runs-on: ubuntu-latest
    outputs:
      buildkit_src_tag: ${{ steps.image_tags.outputs.buildkit_src_tag }}
      buildkit_dst_tag: ${{ steps.image_tags.outputs.buildkit_dst_tag }}
      buildkit_rootless_src_tag: ${{ steps.image_tags.outputs.buildkit_rootless_src_tag }}
      buildkit_rootless_dst_tag: ${{ steps.image_tags.outputs.buildkit_rootless_dst_tag }}
    steps:
      - name: Checkout
        uses: actions/checkout@v3

      - name: Validate user input
        if: github.event.inputs.buildkitVersion != ''
        run: curl --head --fail https://hub.docker.com/v2/repositories/moby/buildkit/tags/${{ inputs.buildkitVersion }}

      - id: buildkit_tag
        name: Extract image tag from Helm values
        uses: mikefarah/yq@v4.33.2
        with:
          cmd: test -n "${{ inputs.buildkitVersion }}" && echo "${{ inputs.buildkitVersion }}" || yq '.buildkit.image.tag' deployments/helm/hephaestus/values.yaml | sed 's/-rootless//'

      - id: image_tags
        name: Construct image tags
        run: |
          IMMUTABLE_SUFFIX="$([[ "${{ inputs.immutable }}" == "true" ]] && echo "-$(date +%Y%m%d%H%M%S)" || echo "")"
          BUILDKIT_INPUT_TAG="${{ steps.buildkit_tag.outputs.result }}"
          BUILDKIT_OUTPUT_TAG="$BUILDKIT_INPUT_TAG$IMMUTABLE_SUFFIX"
          BUILDKIT_ROOTLESS_INPUT_TAG="$BUILDKIT_INPUT_TAG-rootless"
          BUILDKIT_ROOTLESS_OUTPUT_TAG="$BUILDKIT_ROOTLESS_INPUT_TAG$IMMUTABLE_SUFFIX"

          echo "buildkit_src_tag=$BUILDKIT_INPUT_TAG" >> $GITHUB_OUTPUT
          echo "buildkit_dst_tag=$BUILDKIT_OUTPUT_TAG" >> $GITHUB_OUTPUT
          echo "buildkit_rootless_src_tag=$BUILDKIT_ROOTLESS_INPUT_TAG" >> $GITHUB_OUTPUT
          echo "buildkit_rootless_dst_tag=$BUILDKIT_ROOTLESS_OUTPUT_TAG" >> $GITHUB_OUTPUT

  buildkit:
    name: Buildkit
    runs-on: ubuntu-latest
    needs: [process-input]
    steps:
      - name: Checkout
        uses: actions/checkout@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2

      - name: Login to container registry
        uses: docker/login-action@v2
        with:
          registry: quay.io
          username: ${{ secrets.QUAY_USERNAME }}
          password: ${{ secrets.QUAY_PASSWORD }}

      - name: Build and push image to Quay
        uses: docker/build-push-action@v4
        with:
          push: true
          target: root
          context: build/buildkit
          build-args: BUILDKIT_TAG=${{ needs.process-input.outputs.buildkit_src_tag }}
          tags: quay.io/domino/buildkit:${{ needs.process-input.outputs.buildkit_dst_tag }}


  buildkit-rootless:
    name: Buildkit Rootless
    runs-on: ubuntu-latest
    needs: [process-input]
    steps:
      - name: Checkout
        uses: actions/checkout@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2

      - name: Login to container registry
        uses: docker/login-action@v2
        with:
          registry: quay.io
          username: ${{ secrets.QUAY_USERNAME }}
          password: ${{ secrets.QUAY_PASSWORD }}

      - name: Build and push image to Quay
        uses: docker/build-push-action@v4
        with:
          push: true
          target: rootless
          context: build/buildkit
          build-args: BUILDKIT_TAG=${{ needs.process-input.outputs.buildkit_rootless_src_tag }}
          tags: quay.io/domino/buildkit:${{ needs.process-input.outputs.buildkit_rootless_dst_tag }}