.github/workflows/build.yml

name: Build

on:
  workflow_call:
    inputs:
      platforms:
        required: true
        type: string
      image:
        required: true
        type: string
      tag:
        required: false
        type: string

defaults:
  run:
    shell: bash

permissions:
  contents: read

jobs:
  build:
    permissions:
      contents: read # for docker/build-push-action to read repo content
      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
      packages: write # for docker/build-push-action to push to GHCR
      id-token: write # for docker/login to login to NGINX registry
    runs-on: ${{ github.event_name != 'pull_request' && contains(inputs.image, 'plus') && 'kic-plus' || 'ubuntu-24.04' }}
    services:
      registry:
        image: registry:2
        ports:
          - 5000:5000
    steps:
      - name: Checkout Repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          ref: ${{ inputs.tag != '' && format('refs/tags/v{0}', inputs.tag) || github.ref }}

      - name: Fetch Cached Artifacts
        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
        with:
          path: ${{ github.workspace }}/dist
          key: nginx-gateway-fabric-${{ github.run_id }}-${{ github.run_number }}

      - name: Docker Buildx
        uses: docker/setup-buildx-action@6524bf65af31da8d45b59e8c27de4bd072b392f5 # v3.8.0
        with:
          driver-opts: network=host

      - name: Setup QEMU
        uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3.2.0
        with:
          platforms: arm64

      - name: Login to GitHub Container Registry
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        if: ${{ github.event_name != 'pull_request' && ! contains(inputs.image, 'plus') }}
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Get Id Token
        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
        id: idtoken
        with:
          script: |
            let id_token = await core.getIDToken()
            core.setOutput('id_token', id_token)
        if: ${{ github.event_name != 'pull_request' && contains(inputs.image, 'plus')}}

      - name: Login to NGINX Registry
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        with:
          registry: docker-mgmt.nginx.com
          username: ${{ steps.idtoken.outputs.id_token }}
          password: ${{ github.actor }}
        if: ${{ github.event_name != 'pull_request' && contains(inputs.image, 'plus') }}

      - name: Authenticate to Google Cloud
        id: auth
        uses: google-github-actions/auth@6fc4af4b145ae7821d527454aa9bd537d1f2dc5f # v2.1.7
        with:
          token_format: access_token
          workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY }}
          service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }}
        if: ${{ github.event_name != 'pull_request' && contains(inputs.image, 'plus') }}

      - name: Login to GAR
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        with:
          registry: us-docker.pkg.dev
          username: oauth2accesstoken
          password: ${{ steps.auth.outputs.access_token }}
        if: ${{ github.event_name != 'pull_request' && contains(inputs.image, 'plus') }}

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@369eb591f429131d6889c46b94e711f089e6ca96 # v5.6.1
        with:
          context: ${{ inputs.tag != '' && 'git' || 'workflow' }}
          images: |
            name=ghcr.io/nginxinc/nginx-gateway-fabric,enable=${{ inputs.image == 'ngf' && github.event_name != 'pull_request' }}
            name=ghcr.io/nginxinc/nginx-gateway-fabric/nginx,enable=${{ inputs.image == 'nginx' && github.event_name != 'pull_request' }}
            name=docker-mgmt.nginx.com/nginx-gateway-fabric/nginx-plus,enable=${{ inputs.image == 'plus' && github.event_name != 'pull_request' }}
            name=us-docker.pkg.dev/${{ secrets.GCP_PROJECT_ID }}/nginx-gateway-fabric/nginx-plus,enable=${{ inputs.image == 'plus' && github.event_name != 'pull_request' }}
            name=localhost:5000/nginx-gateway-fabric/${{ inputs.image }}
          flavor: |
            latest=${{ (inputs.tag != '' && 'true') || 'auto' }}
          tags: |
            type=semver,pattern={{version}}
            type=edge
            type=schedule
            type=ref,event=pr
            type=ref,event=branch,suffix=-rc,enable=${{ startsWith(github.ref, 'refs/heads/release') }}
            type=raw,value=${{ inputs.tag }},enable=${{ inputs.tag != '' }}
          labels: |
            org.opencontainers.image.documentation=https://docs.nginx.com/nginx-gateway-fabric
            org.opencontainers.image.vendor=NGINX Inc <kubernetes@nginx.com>
          annotations: |
            org.opencontainers.image.documentation=https://docs.nginx.com/nginx-gateway-fabric
            org.opencontainers.image.vendor=NGINX Inc <kubernetes@nginx.com>
            io.artifacthub.package.readme-url=https://raw.githubusercontent.com/nginxinc/nginx-gateway-fabric/main/README.md
            io.artifacthub.package.logo-url=https://docs.nginx.com/nginx-gateway-fabric/images/icons/NGINX-product-icon.svg
            io.artifacthub.package.maintainers=[{"name":"NGINX Inc","email":"kubernetes@nginx.com"}]
            io.artifacthub.package.license=Apache-2.0
            io.artifacthub.package.keywords=kubernetes,gateway,nginx
        env:
          DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,index

      - name: Build Docker Image
        uses: docker/build-push-action@48aba3b46d1b1fec4febb7c5d0c644b249a11355 # v6.10.0
        with:
          file: build/Dockerfile${{ inputs.image == 'nginx' && '.nginx' || '' }}${{ inputs.image == 'plus' && '.nginxplus' || '' }}
          context: "."
          target: ${{ inputs.image == 'ngf' && 'goreleaser' || '' }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          annotations: ${{ steps.meta.outputs.annotations }}
          push: true
          platforms: ${{ inputs.platforms }}
          cache-from: type=gha,scope=${{ inputs.image }}
          cache-to: type=gha,scope=${{ inputs.image }},mode=max
          pull: true
          no-cache: ${{ github.event_name != 'pull_request' }}
          sbom: true
          provenance: mode=max
          build-args: |
            NJS_DIR=internal/mode/static/nginx/modules/src
            NGINX_CONF_DIR=internal/mode/static/nginx/conf
            BUILD_AGENT=gha
          secrets: |
            ${{ contains(inputs.image, 'plus') && format('"nginx-repo.crt={0}"', secrets.NGINX_CRT) || '' }}
            ${{ contains(inputs.image, 'plus') && format('"nginx-repo.key={0}"', secrets.NGINX_KEY) || '' }}

      - name: Inspect SBOM and output manifest
        run: |
          docker buildx imagetools inspect localhost:5000/nginx-gateway-fabric/${{ inputs.image }}:${{ steps.meta.outputs.version }} --format '{{ json (index .SBOM "linux/amd64").SPDX }}' > sbom-${{ inputs.image }}.json
          docker buildx imagetools inspect localhost:5000/nginx-gateway-fabric/${{ inputs.image }}:${{ steps.meta.outputs.version }} --raw

      - name: Scan SBOM
        id: scan
        uses: anchore/scan-action@abae793926ec39a78ab18002bc7fc45bbbd94342 # v6.0.0
        with:
          sbom: "sbom-${{ inputs.image }}.json"
          only-fixed: true
          add-cpes-if-none: true
          fail-build: false

      - name: Upload scan result to GitHub Security tab
        uses: github/codeql-action/upload-sarif@48ab28a6f5dbc2a99bf1e0131198dd8f1df78169 # v3.28.0
        continue-on-error: true
        with:
          sarif_file: ${{ steps.scan.outputs.sarif }}
          category: build-${{ inputs.image }}
        if: always()

      - name: Upload Scan Results
        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
        continue-on-error: true
        with:
          name: scan-results-${{ inputs.image }}
          path: |
            ${{ steps.scan.outputs.sarif }}
            *.json
            !sbom-plus.json
        if: always()