reusable_build_image.yaml

---
on:
  workflow_call:
    inputs:
      product-name:
        description: The boil product directory name (e.g. "hadoop" or "precompiled/hadoop")
        required: true
        type: string
      image-name:
        description: |
          The image name used in the OCI registry. Defaults to product-name if not set.
          This is used when the boil directory is nested (eg: precompiled/hadoop) but
          the parent directory will be used as the namespace (eg: precompiled).
        default: ""
        type: string
      sdp-version:
        required: true
        type: string
      registry-namespace:
        required: true
        type: string
      runners:
        description: |
          The type of runners used.
          - `mixed`: x86_64 builds run on the GitHub hosted runners and the aarch64 builds run on the Ubicloud runners
          - `ubicloud`: Both the x86_64 and the aarch64 builds run on the Ubicloud runners
        default: mixed
        type: string
    secrets:
      harbor-robot-secret:
        description: The secret for the Harbor robot user used to push images and manifest
        required: true
      slack-token:
        description: The Slack token used to post failure notifications
        required: true

permissions: {}

jobs:
  generate_runner_dimension:
    name: Generate Runner Dimension
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false

      - id: runners
        shell: bash
        env:
          RUNNERS_TYPE: ${{ inputs.runners }}
        run: |
          if [ "$RUNNERS_TYPE" == "mixed" ]; then
            RUNNERS=$(jq --compact-output < .github/workflows/runners/mixed.json)
            echo "RUNNERS=$RUNNERS" | tee -a "$GITHUB_OUTPUT"
          elif [ "$RUNNERS_TYPE" == "ubicloud" ]; then
            RUNNERS=$(jq --compact-output < .github/workflows/runners/ubicloud.json)
            echo "RUNNERS=$RUNNERS" | tee -a "$GITHUB_OUTPUT"
          else
            echo "Invalid runners type, expected 'mixed' or 'ubicloud'"
            exit 1
          fi
    outputs:
      runners: ${{ steps.runners.outputs.RUNNERS }}

  generate_version_dimension:
    name: Generate Version Dimension
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false

      - id: shard
        uses: stackabletech/actions/shard@8a8085be0a8cec3d24ad3970e602d65be487da6a # v0.14.1
        with:
          product-name: ${{ inputs.product-name }}
    outputs:
      versions: ${{ steps.shard.outputs.versions }}

  build:
    name: Build/Publish ${{ matrix.versions }}-${{ matrix.runner.arch }} Image
    needs:
      - generate_version_dimension
      - generate_runner_dimension
    permissions:
      id-token: write
      contents: read
    runs-on: ${{ matrix.runner.name }}
    strategy:
      fail-fast: false
      matrix:
        versions: ${{ fromJson(needs.generate_version_dimension.outputs.versions) }}
        runner: ${{ fromJson(needs.generate_runner_dimension.outputs.runners) }}
    steps:
      - name: Checkout Repository
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false

      - name: Free Disk Space
        uses: stackabletech/actions/free-disk-space@8a8085be0a8cec3d24ad3970e602d65be487da6a # v0.14.1

      - name: Build Product Image
        id: build
        uses: stackabletech/actions/build-product-image@8a8085be0a8cec3d24ad3970e602d65be487da6a # v0.14.1
        with:
          registry-namespace: ${{ inputs.registry-namespace }}
          product-name: ${{ inputs.product-name }}
          product-version: ${{ matrix.versions }}
          sdp-version: ${{ inputs.sdp-version }}

      - name: Publish Container Image on oci.stackable.tech
        uses: stackabletech/actions/publish-image@8a8085be0a8cec3d24ad3970e602d65be487da6a # v0.14.1
        with:
          image-registry-uri: oci.stackable.tech
          image-registry-username: robot$${{ inputs.registry-namespace }}+github-action-build
          image-registry-password: ${{ secrets.harbor-robot-secret }}
          # NOTE (@NickLarsenNZ): This fallback is just for now so we can support both repo level
          # image folders that go under the sdp namespace AND nested image folders that contain the
          # namespace (for example precommit/hadoop).
          # In future, we probably want to encode this information in the boil config metadata per
          # registry so we don't have to do such gymnastics in the workflow.
          image-repository: ${{ inputs.registry-namespace }}/${{ inputs.image-name || inputs.product-name }}
          image-manifest-tag: ${{ steps.build.outputs.image-manifest-tag }}
          source-image-uri: localhost/${{ inputs.registry-namespace }}/${{ inputs.product-name }}:${{ steps.build.outputs.image-manifest-tag }}
  publish_manifests:
    name: Build/Publish ${{ matrix.versions }} Manifests
    needs: [generate_version_dimension, build]
    permissions:
      id-token: write
      contents: read
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        versions: ${{ fromJson(needs.generate_version_dimension.outputs.versions) }}
    steps:
      - name: Checkout Repository
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false

      - name: Publish and Sign Image Index Manifest to oci.stackable.tech
        uses: stackabletech/actions/publish-image-index-manifest@8a8085be0a8cec3d24ad3970e602d65be487da6a # v0.14.1
        with:
          image-registry-uri: oci.stackable.tech
          image-registry-username: robot$${{ inputs.registry-namespace }}+github-action-build
          image-registry-password: ${{ secrets.harbor-robot-secret }}
          # NOTE (@NickLarsenNZ): This fallback is just for now so we can support both repo level
          # image folders that go under the sdp namespace AND nested image folders that contain the
          # namespace (for example precommit/hadoop).
          # In future, we probably want to encode this information in the boil config metadata per
          # registry so we don't have to do such gymnastics in the workflow.
          image-repository: ${{ inputs.registry-namespace }}/${{ inputs.image-name || inputs.product-name }}
          image-index-manifest-tag: ${{ matrix.versions }}-stackable${{ inputs.sdp-version }}

  notify:
    name: Failure Notification
    needs: [generate_version_dimension, build, publish_manifests]
    runs-on: ubuntu-latest
    # TODO (@NickLarsenNZ): Allow a condition from input so that we can always
    # be notified of new builds for precompiled product images.
    if: failure() || (github.run_attempt > 1 && !cancelled())
    steps:
      - name: Send Notification
        uses: stackabletech/actions/send-slack-notification@8a8085be0a8cec3d24ad3970e602d65be487da6a # v0.14.1
        with:
          publish-manifests-result: ${{ needs.publish_manifests.result }}
          build-result: ${{ needs.build.result }}
          slack-token: ${{ secrets.slack-token }}
          channel-id: C07UG6JH44F # notifications-container-images
          type: container-image-build