go-base.yaml

name: go-base

on:
  push:

jobs:
  prepare-go-dev:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Run Prepare Action
        uses: buildsafedev/multiarch-build--action/prepare-action@main
        with:
          oci_registry_username: ${{ secrets.DOCKER_USERNAME }}
          oci_registry_password: ${{ secrets.DOCKER_PASSWORD }}
          image_name: holiodin01/go-base-dev
          ociBlock: go-dev
          tag: v0.1.0

  prepare-go-runtime:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Run Prepare Action
        uses: buildsafedev/multiarch-build--action/prepare-action@main
        with:
          oci_registry_username: ${{ secrets.DOCKER_USERNAME }}
          oci_registry_password: ${{ secrets.DOCKER_PASSWORD }}
          image_name: holiodin01/go-base-runtime
          ociBlock: go-runtime
          tag: v0.1.0

  # Build the oci images for dev and runtime
  build:
    needs : [prepare-go-dev, prepare-go-runtime]
    strategy:
      fail-fast: false
      matrix:
        platform: [ubuntu-latest, linux-arm64]  
    runs-on: ${{ matrix.platform }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      
      - name: Run Build Action
        uses: buildsafedev/multiarch-build--action/build-action@main
        with:
          oci_registry_username: ${{ secrets.DOCKER_USERNAME }}
          oci_registry_password: ${{ secrets.DOCKER_PASSWORD }}
          ociBlocks: go-dev go-runtime
          directory: 'go-server-example'

  # This pirticular job is used to merge the development image of arm64 and amd64
  merge-dev:
    needs: build
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      
      - name: Run Merge Action
        uses: buildsafedev/multiarch-build--action/merge-action@main
        with:
          oci_registry_username: ${{ secrets.DOCKER_USERNAME }}
          oci_registry_password: ${{ secrets.DOCKER_PASSWORD }}
          image_name: holiodin01/go-base-dev
          ociBlock: go-dev
          tag: v0.1.0
  merge-runtime:
    needs: build
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      
      - name: Run Merge Action
        uses: buildsafedev/multiarch-build--action/merge-action@main
        with:
          oci_registry_username: ${{ secrets.DOCKER_USERNAME }}
          oci_registry_password: ${{ secrets.DOCKER_PASSWORD }}
          image_name: holiodin01/go-base-runtime
          ociBlock: go-runtime
          tag: v0.1.0
  
  hermetic_builds:
    needs: [merge-dev, merge-runtime]
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        
      - name : Replace base image in Dockerfile
        run: |
          # This is a hack to replace the base image in the Dockerfile , you can also use docker cmd also
          sed -i "s|FROM .* AS base|FROM holiodin01/go-base-dev:v0.1.0 AS base|g" go-server-example/Dockerfile
          sed -i "s|FROM .* AS final|FROM holiodin01/go-base-runtime:v0.1.0 AS final|g" go-server-example/Dockerfile

          cat go-server-example/Dockerfile

      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}
      - name : Build hermetic image
        working-directory: go-server-example
        run: |

          docker buildx create --name mybuilder --use --driver docker-container

          docker buildx build \
            --no-cache \
            --tag holiodin01/go-final:latest \
            --network=none \
            --attest type=provenance,mode=min \
            --platform=linux/amd64 \
            --push \
            --output type=oci \
            https://github.com/buildsafedev/examples.git\#multiarch-builds:go-server-example 
        
      - name: Install Nix
        uses: DeterminateSystems/nix-installer-action@main
      
          # Setup Nix development environment make sure to use ./ before the path otherwise nix takes it as a https url
      - name: Setup Nix development environment
        uses: nicknovitski/nix-develop@v1
        with:
          arguments: ./go-server-example/bsf/.#devShell
      
      - name: Is hermetic build
        run: |
            docker buildx imagetools inspect holiodin01/go-final:latest --format "{{ json .Provenance.SLSA }}" > slsa.json
            cat slsa.json
            if [ "$(jq -r '.build.builder' slsa.json)" == "hermetic" ]; then
              echo "Hermetic build"
             else
              echo "Not hermetic build"
            fi
          
      # Check for vulnerabilities :)
      - name: Check for vulnerabilities
        run: grype holiodin01/go-final:latest
      
      
      # Sign and push the image 
      - name: Sign and push image
        run: |
            export COSIGN_PASSWORD=${{ secrets.COSIGN_PASSWORD }}
            echo "${{secrets.COSIGN_PRIVATE_KEY}}" > cosign.key
            echo "${{secrets.COSIGN_PUBLIC_KEY}}" > cosign.pub

            cosign sign --yes --key cosign.key holiodin01/go-final:latest
            cosign verify --key cosign.pub  holiodin01/go-final:latest
            cosign triangulate holiodin01/go-final:latest