build.yml

name: build
on:
  push:
    branches:
      - main
  release:
    types: [published]
  pull_request:
env:
  GO_VERSION: '1.22'
  NIX_VERSION: '2.18.1'
  BOM_VERSION: v0.5.1

permissions: {}

jobs:
  macos:
    runs-on: macos-12
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v3.5.2
      - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491
        with:
          go-version: ${{ env.GO_VERSION }}
      - run: make test-unit
      - run: make verify-go-lint

  nix:
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v3.5.2
      - uses: cachix/install-nix-action@6004951b182f8860210c8d6f0d808ec5b1a33d28
        with:
          install_url: https://releases.nixos.org/nix/nix-${{ env.NIX_VERSION }}/install
      - uses: cachix/cachix-action@18cf96c7c98e048e10a83abd92116114cd8504be
        with:
          name: security-profiles-operator
          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
          pushFilter: security-profiles-operator
      - run: make nix
      - uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
        with:
          name: build
          path: build.tar.gz

  nix-spoc:
    if: github.ref == 'refs/heads/main' || contains(github.ref, 'refs/tags')
    runs-on: ubuntu-22.04
    permissions:
      contents: write  # required for updating the release
      id-token: write  # required for sigstore signing
    steps:
      - uses: sigstore/cosign-installer@e1523de7571e31dbe865fd2e80c5c7c23ae71eb4 # v3.4.0
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v3.5.2
      - uses: cachix/install-nix-action@6004951b182f8860210c8d6f0d808ec5b1a33d28
        with:
          install_url: https://releases.nixos.org/nix/nix-${{ env.NIX_VERSION }}/install
      - uses: cachix/cachix-action@18cf96c7c98e048e10a83abd92116114cd8504be
        with:
          name: security-profiles-operator
          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
          pushFilter: security-profiles-operator
      - run: |
          sudo curl -sSfL --retry 5 --retry-delay 3 -o /usr/bin/bom \
            https://github.com/kubernetes-sigs/bom/releases/download/${{ env.BOM_VERSION }}/bom-amd64-linux
          sudo chmod +x /usr/bin/bom
      - run: make nix-spoc
      - uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
        with:
          name: spoc
          path: |
            build/*
      - uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v0.1.15
        if: startsWith(github.ref, 'refs/tags/')
        with:
          files: |
            build/*

  bpf:
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491
        with:
          go-version: ${{ env.GO_VERSION }}
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v3.5.2
      - uses: cachix/install-nix-action@6004951b182f8860210c8d6f0d808ec5b1a33d28
        with:
          install_url: https://releases.nixos.org/nix/nix-${{ env.NIX_VERSION }}/install
      - uses: cachix/cachix-action@18cf96c7c98e048e10a83abd92116114cd8504be
        with:
          name: security-profiles-operator
          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
          pushFilter: security-profiles-operator
      - run: make verify-bpf

  build-image:
    runs-on: ubuntu-22.04
    steps:
      - name: Remove unnecessary files
        run: |
          sudo rm -rf /usr/share/dotnet
          sudo rm -rf "$AGENT_TOOLSDIRECTORY"
          sudo rm -rf /opt/ghc
          sudo rm -rf /usr/local/share/boost
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v3.5.2
      - name: Set up Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@0d103c3126aa41d772a8362f6aa67afac040f80c
      - name: Login to Quay
        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d
        with:
          registry: quay.io/security-profiles-operator
          username: security-profiles-operator+github
          password: ${{ secrets.QUAY_TOKEN }}
        if: github.ref == 'refs/heads/main'
      - name: Image metadata
        id: meta
        uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # v5.5.1
        with:
          images: |
            quay.io/security-profiles-operator/build
          tags: |
            type=ref,event=branch
            type=ref,event=pr
            type=ref,event=tag
            type=sha,format=long
      - name: Build (and push if needed)
        uses: docker/build-push-action@4a13e500e55cf31b7a5d59a38ab2040ab0f42f56
        with:
          context: .
          file: Dockerfile.build-image
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          push: ${{ github.ref == 'refs/heads/main' }}
          # Only load on PR builds
          load: ${{ github.ref != 'refs/heads/main' }}
      - name: Run container image vulnerability scanner
        uses: aquasecurity/trivy-action@062f2592684a31eb3aa050cc61e7ca1451cecd3d
        with:
          image-ref: ${{ fromJSON(steps.meta.outputs.json).tags[0] }}
          format: 'table'
          exit-code: '0'
          ignore-unfixed: true
          vuln-type: 'os,library'
          severity: 'CRITICAL,HIGH'
          timeout: 30m

  operator-image:
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v3.5.2
      - name: Set up Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@0d103c3126aa41d772a8362f6aa67afac040f80c
      - name: Login to Quay
        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d
        with:
          registry: quay.io/security-profiles-operator
          username: security-profiles-operator+github
          password: ${{ secrets.QUAY_TOKEN }}
        if: github.ref == 'refs/heads/main'
      - name: Image metadata
        id: meta
        uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # v5.5.1
        with:
          images: |
            quay.io/security-profiles-operator/spo
          tags: |
            type=ref,event=branch
            type=ref,event=pr
            type=ref,event=tag
            type=sha,format=long
      - name: Build
        uses: docker/build-push-action@4a13e500e55cf31b7a5d59a38ab2040ab0f42f56
        with:
          context: .
          file: Dockerfile
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          load: true
      - name: Run container image vulnerability scanner
        uses: aquasecurity/trivy-action@062f2592684a31eb3aa050cc61e7ca1451cecd3d
        with:
          image-ref: ${{ fromJSON(steps.meta.outputs.json).tags[0] }}
          format: 'table'
          exit-code: '1'
          ignore-unfixed: true
          vuln-type: 'os,library'
          severity: 'CRITICAL,HIGH'

  ubi-image:
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v3.5.2
      - name: Set up Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@0d103c3126aa41d772a8362f6aa67afac040f80c
      - name: Login to Quay
        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d
        with:
          registry: quay.io/security-profiles-operator
          username: security-profiles-operator+github
          password: ${{ secrets.QUAY_TOKEN }}
        if: github.ref == 'refs/heads/main'
      - name: Image metadata
        id: meta
        uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81
        with:
          images: |
            quay.io/security-profiles-operator/build
          flavor: |
            suffix=-ubi
          tags: |
            type=ref,event=branch
            type=ref,event=pr
            type=ref,event=tag
            type=sha,format=long
      # TODO(jaosorior): Push UBI image too
      - name: Build
        uses: docker/build-push-action@4a13e500e55cf31b7a5d59a38ab2040ab0f42f56
        with:
          context: .
          file: Dockerfile.ubi
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          load: true
      - name: Run container image vulnerability scanner
        uses: aquasecurity/trivy-action@062f2592684a31eb3aa050cc61e7ca1451cecd3d
        with:
          image-ref: ${{ fromJSON(steps.meta.outputs.json).tags[0] }}
          format: 'table'
          exit-code: '1'
          ignore-unfixed: true
          vuln-type: 'os,library'
          severity: 'CRITICAL,HIGH'