build-base.yml

name: build-base/alpine

on:
  push:
    branches-ignore:
    - "renovate/**"
    paths:
    - "build-base/**"
    - "!build-base/*/README.md"
    - "!build-base/wolfi/**"
    - ".github/workflows/build-base.yml"
  pull_request:
    types:
    - opened
    - synchronize
    - labeled
    - reopened
    paths:
    - "build-base/**"
    - "!build-base/*/README.md"
    - "!build-base/wolfi/**"
    - ".github/workflows/build-base.yml"
  schedule:
  - cron: '0 7 * * *'
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}
  cancel-in-progress: true

jobs:
  build:
    name: docker-build
    permissions:
      packages: write
      id-token: write
    runs-on: ubuntu-latest
    env:
      REGISTRY: ghcr.io
      IMAGE_NAME: build-base
    strategy:
      matrix:
        IMAGE_TAG:
        - "3.19"
        - "3.20"
    steps:

    - name: Checkout
      uses: actions/checkout@v4

    - name: Set SOURCE_DATE_EPOCH
      id: set-source-date-epoch
      run: |
        echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct build-base/Dockerfile)" >>"${GITHUB_ENV}"

    - name: Set up QEMU
      uses: docker/setup-qemu-action@v3

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3

    - name: Login to GitHub Container Registry
      uses: docker/#-action@v3
      with:
        registry: ${{ env.REGISTRY }}
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}

    - name: Build
      id: build
      uses: docker/build-push-action@v6
      env:
        SOURCE_DATE_EPOCH: ${{ steps.set-source-date-epoch.outputs.SOURCE_DATE_EPOCH }}
      with:
        context: build-base
        platforms: linux/amd64,linux/arm64
        provenance: true
        sbom: true
        cache-from: ${{ env.REGISTRY }}/${{ github.repository }}/${{ env.IMAGE_NAME }}:${{ matrix.IMAGE_TAG }}
        build-args: |
          VERSION=${{ matrix.IMAGE_TAG }}
        push: ${{ github.event_name != 'pull_request' }}
        tags: ${{ env.REGISTRY }}/${{ github.repository }}/${{ env.IMAGE_NAME }}:${{ matrix.IMAGE_TAG }}

    - name: Install cosign
      if: ${{ github.event_name != 'pull_request' }}
      uses: sigstore/cosign-installer@v3

    - name: Sign
      if: ${{ github.event_name != 'pull_request' }}
      env:
        COSIGN_EXPERIMENTAL: "true"
      run: cosign sign -y ${{ env.REGISTRY }}/${{ github.repository }}/${{ env.IMAGE_NAME }}@${{ steps.build.outputs.digest }}

    - name: Run Trivy vulnerability scanner
      if: ${{ github.event_name != 'pull_request' }}
      uses: aquasecurity/trivy-action@master
      with:
        image-ref: ${{ env.REGISTRY }}/${{ github.repository }}/${{ env.IMAGE_NAME }}:${{ matrix.IMAGE_TAG }}
        format: 'table'
        exit-code: '1'
        ignore-unfixed: true
        severity: 'CRITICAL,HIGH'