images.yml

name: images

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

permissions:
  contents: read
  packages: write

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  read-config:
    name: Read config
    runs-on: ubuntu-latest
    outputs:
      kernel: ${{ steps.kernel.outputs.config }}

    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Read versions.json
      id: kernel
      run: |
        {
          echo "config<<EOF"
          cat versions.json
          echo -e "\nEOF"
        } | tee -a "$GITHUB_OUTPUT"

  build-and-push:
    name: Build And Push
    runs-on: ubuntu-latest
    needs: read-config
    strategy:
      matrix:
        kernel_version: ${{ fromJSON(needs.read-config.outputs.kernel).versions }}
    env:
      LATEST_STABLE: ${{ fromJSON(needs.read-config.outputs.kernel).latest_stable }}
      LATEST_VERSION: ${{ fromJSON(needs.read-config.outputs.kernel).versions[0] }}

    steps:
    - name: Checkout
      uses: actions/checkout@v4

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3

    - name: Cache ccache output
      uses: actions/cache@v3
      with:
        path: ccache
        key: ccache-${{ matrix.kernel_version }}-${{ hashFiles('config') }}

    - name: Inject ccache into builder
      uses: reproducible-containers/buildkit-cache-dance@v2.1.3
      with:
        cache-source: ccache
        cache-target: /root/.ccache

    - name: Kernel metadata
      id: meta
      uses: docker/metadata-action@v5
      with:
        images: ghcr.io/${{ github.repository_owner }}/ci-kernels
        flavor: latest=false
        tags: |
          type=raw,value=${{ matrix.kernel_version }}
          type=match,pattern=^\d+\.\d+,group=0,value=${{ matrix.kernel_version }}
        labels: |
          org.opencontainers.image.created=
          org.opencontainers.image.revision=

    - name: Selftests metadata
      id: selftests-meta
      uses: docker/metadata-action@v5
      with:
        images: ghcr.io/${{ github.repository_owner }}/ci-kernels
        flavor: latest=false
        tags: |
          type=raw,value=${{ matrix.kernel_version }},suffix=-selftests
          type=match,pattern=^\d+\.\d+,group=0,value=${{ matrix.kernel_version }},suffix=-selftests
        labels: |
          org.opencontainers.image.created=
          org.opencontainers.image.revision=

    - name: Log in to GitHub Container Registry
      if: github.ref == 'refs/heads/main'
      uses: docker/login-action@v3
      with:
        registry: ghcr.io
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}

    - name: Build kernel
      uses: docker/build-push-action@v5
      with:
        target: vmlinux
        provenance: false
        platforms: |
          linux/amd64
          ${{ matrix.kernel_version == env.LATEST_VERSION && 'linux/arm64' || '' }}
        build-args: |
          KERNEL_VERSION=${{ matrix.kernel_version }}
        tags: ${{ steps.meta.outputs.tags }}
        labels: ${{ steps.meta.outputs.labels }}
        annotations: ${{ steps.meta.outputs.annotations }}
        outputs: ${{ github.ref == 'refs/heads/main' && 'type=registry' || 'type=oci,dest=/tmp/vmlinux.tar' }}

    - name: Build selftests
      if: matrix.kernel_version == env.LATEST_STABLE
      uses: docker/build-push-action@v5
      with:
        target: selftests-bpf
        provenance: false
        platforms: |
          linux/amd64
        build-args: |
          KERNEL_VERSION=${{ matrix.kernel_version }}
        tags: ${{ steps.selftests-meta.outputs.tags }}
        labels: ${{ steps.selftests-meta.outputs.labels }}
        annotations: ${{ steps.selftests-meta.outputs.annotations }}
        outputs: ${{ github.ref == 'refs/heads/main' && 'type=registry' || 'type=oci,dest=/tmp/selftests-bpf.tar' }}

    - name: Store images
      if: github.ref != 'refs/heads/main'
      uses: actions/upload-artifact@v3
      with:
        name: Images (${{ matrix.kernel_version }})
        path: '/tmp/*.tar'
        retention-days: 1

  results:
    if: ${{ always() }}
    runs-on: ubuntu-latest
    name: Final Results
    needs:
    - build-and-push
    steps:
    - run: exit 1
      if: >-
        ${{
              contains(needs.*.result, 'failure')
          || contains(needs.*.result, 'cancelled')
        }}