build-kbs-image.yml

name: Build KBS Image

on:
  workflow_call:
    inputs:
      build_option:
        description: 'Build option for the image'
        type: string
        required: false

jobs:
  build_kbs_image:
    strategy:
      fail-fast: false
      matrix:
        instance:
          - ubuntu-latest
          - s390x
        tag:
          - kbs
          - kbs-grpc-as
          - kbs-ita-as
          - rhel-ubi
        exclude:
          - instance: s390x
            tag: kbs-ita-as
          - instance: s390x
            tag: rhel-ubi
        include:
          - tag: kbs
            docker_file: kbs/docker/Dockerfile
            name: build-in AS
          - tag: kbs-grpc-as
            docker_file: kbs/docker/coco-as-grpc/Dockerfile
            name: gRPC AS
          - tag: kbs-ita-as
            docker_file: kbs/docker/intel-trust-authority/Dockerfile
            name: Intel Trust Authority AS
          - tag: rhel-ubi
            docker_file: kbs/docker/rhel-ubi/Dockerfile
            name: RHEL UBI AS

    runs-on: ${{ matrix.instance }}

    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3

    - name: Login to GHCR Container Registry
      uses: docker/login-action@v3
      with:
        registry: ghcr.io
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}

    - name: Build Container Image KBS (${{ matrix.name }})
      run: |
        commit_sha=${{ github.sha }}
        arch=$(uname -m)
        DOCKER_BUILDKIT=1 docker build -f "${{ matrix.docker_file }}" ${{ inputs.build_option }} \
          -t "ghcr.io/confidential-containers/staged-images/${{ matrix.tag }}:${commit_sha}-${arch}" \
          -t "ghcr.io/confidential-containers/staged-images/${{ matrix.tag }}:latest-${arch}" \
          --build-arg ARCH="${arch}" .