build.yml

# SPDX-FileCopyrightText: Copyright 2025-2026 The Secureblue Authors
#
# SPDX-License-Identifier: Apache-2.0
name: build

permissions: {}

on:
  schedule:
    - cron:
        "00 08 * * *"
  push:
    paths-ignore: 
      - "**.md"

  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
  cancel-in-progress: true

jobs:
  build:
    name: Build
    runs-on: ubuntu-24.04
    outputs:
      FULL_IMAGE_REF: ${{ steps.image_data.outputs.FULL_IMAGE_REF }}
      IMAGE_DIGEST: ${{ steps.image_manifest_metadata.outputs.IMAGE_DIGEST }}
    permissions:
      contents: read
      packages: write
      id-token: write
    strategy:
      fail-fast: false 
      matrix:
        recipe:
          - silverblue-startingleaf.yml
    steps:
      - name: Checkout repo
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Optimize build times
        shell: bash
        run: |
          echo 'set man-db/auto-update false' | sudo debconf-communicate
          sudo dpkg-reconfigure man-db
          sudo rm -f /var/lib/man-db/auto-update
          sudo sed -i 's/^update_initramfs=.*/update_initramfs=no/' /etc/initramfs-tools/update-initramfs.conf

      - name: Drop Ubuntu HTTP mirrors
        shell: bash
        run: |
          sudo sed -i '/^http:\/\//d' /etc/apt/apt-mirrors.txt
          sudo apt-get update

      - name: Install dependencies
        shell: bash
        run: |
          sudo apt install yq

      - name: Gather image data from recipe
        id: image_data
        shell: bash
        env:
          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
          PR_EVENT_NUMBER: ${{ github.event.number }}
          RECIPE: ${{ matrix.recipe }}
        run: |
          IMAGE_NAME=$(yq -r '."name"' "./recipes/${RECIPE}")
          echo "IMAGE_NAME=${IMAGE_NAME}" >> "${GITHUB_OUTPUT}"
          echo "BASE_IMAGE=$(yq -r '."base-image"' "./recipes/${RECIPE}")" >> "${GITHUB_OUTPUT}"
          echo "BASE_IMAGE_VERSION=$(yq -r '."image-version"' "./recipes/${RECIPE}")" >> "${GITHUB_OUTPUT}"

          FULL_IMAGE_REF="ghcr.io/oakleafknight06/silverblue-startingleaf:latest"
          echo "FULL_IMAGE_REF=${FULL_IMAGE_REF}" >> "${GITHUB_OUTPUT}"

      - name: Install slsa-verifier
        uses: slsa-framework/slsa-verifier/actions/installer@ea584f4502babc6f60d9bc799dbbb13c1caa9ee6 # v2.7.1

      - name: Verify base image provenance
        shell: bash
        env:
          BASE_IMAGE_VERSION: ${{ steps.image_data.outputs.BASE_IMAGE_VERSION }}
          BASE_IMAGE: ${{ steps.image_data.outputs.BASE_IMAGE }}
        run: |
          # Install crane
          CRANE_VERSION=v0.20.7
          CRANE_OS=Linux
          CRANE_ARCH=x86_64
            curl -fLsS --retry 5 \
              -o 'go-containerregistry.tar.gz' "https://github.com/google/go-containerregistry/releases/download/${CRANE_VERSION}/go-containerregistry_${CRANE_OS}_${CRANE_ARCH}.tar.gz" \
              -o 'provenance.intoto.jsonl' "https://github.com/google/go-containerregistry/releases/download/${CRANE_VERSION}/multiple.intoto.jsonl"
          slsa-verifier verify-artifact go-containerregistry.tar.gz --provenance-path provenance.intoto.jsonl --source-uri github.com/google/go-containerregistry --source-tag "${CRANE_VERSION}"
          tar -zxvf go-containerregistry.tar.gz -C /usr/local/bin/ crane

          DIGEST=$(crane digest "${BASE_IMAGE}:${BASE_IMAGE_VERSION}")
          slsa-verifier verify-image --source-uri 'github.com/secureblue/secureblue' "${BASE_IMAGE}:${BASE_IMAGE_VERSION}@${DIGEST}"

      - name: Uninstall slsa-verifier
        shell: bash
        run: |
          # remove slsa-verifier so that it can be successfully reinstalled later by bluebuild
          rm -rf ~/.slsa/

      - name: Install cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
        with:
          cosign-release: 'v2.6.0'

      - name: Verify base image
        shell: bash
        env:
          BASE_IMAGE_VERSION: ${{ steps.image_data.outputs.BASE_IMAGE_VERSION }}
          BASE_IMAGE: ${{ steps.image_data.outputs.BASE_IMAGE }}
        run: |
          UPSTREAM_CONTAINER="${BASE_IMAGE}:${BASE_IMAGE_VERSION}"
          UPSTREAM_PUBKEY='./files/system/etc/pki/containers/secureblue.pub'
          if ! cosign verify --key "${UPSTREAM_PUBKEY}" "${UPSTREAM_CONTAINER}" | jq; then
            echo "NOTICE: Verification failed. Please ensure your public key is correct."
            exit 1
          fi

      - name: Build image
        uses: blue-build/github-action@836161eb076426a451e6a0054f722b1153b8b3ad # v1.12.0
        env:
          KERNEL_PRIVKEY: ${{ secrets.KERNEL_PRIVKEY }}
        with:
          cli_version: v0.9.32
          recipe: ${{ matrix.recipe }}
          cosign_private_key: ${{ secrets.SIGNING_SECRET }}
          registry_token: ${{ github.token }}
          pr_event_number: ${{ github.event.number }}
          squash: true
          skip_checkout: true
          use_cache: false
          retry_push_count: 3
          verify_install: true

      - name: Install regctl
        uses: regclient/actions/regctl-installer@1b705e32d40851370799ea5814e83d0a5f6a70dc # v0.1.0

      - name: Parse image manifest
        id: image_manifest_metadata
        shell: bash
        env:
          FULL_IMAGE_REF: ${{ steps.image_data.outputs.FULL_IMAGE_REF }}
        run: |
          IMAGE_DIGEST=$(regctl image digest "${FULL_IMAGE_REF}")
          echo "IMAGE_DIGEST=${IMAGE_DIGEST}" >> "${GITHUB_OUTPUT}"

  provenance:
    needs: [build]
    permissions:
      actions: read # for detecting the Github Actions environment.
      id-token: write # for creating OIDC tokens for signing.
      packages: write # for uploading attestations.
    # Currently this must be referenced by tag, not by hash:
    # https://github.com/slsa-framework/slsa-github-generator?tab=readme-ov-file#referencing-slsa-builders-and-generators
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0
    with:
      image: ${{ needs.build.outputs.FULL_IMAGE_REF }}
      digest: ${{ needs.build.outputs.IMAGE_DIGEST }}
      registry-username: ${{ github.actor }}
    secrets:
      registry-password: ${{ secrets.GITHUB_TOKEN }}