build-fb-image.yaml

name: Building Fluent Bit image

on:
  push:
    branches:
      - 'master'
    tags:
      - 'v*'
    paths:
      - ".github/workflows/build-fb-image.yaml"
      - "cmd/fluent-watcher/fluentbit/**"
      - "cmd/fluent-watcher/hooks/**"
      - "pkg/filenotify/**"
  pull_request:
    branches:
      - "master"
    paths:
      - ".github/workflows/build-fb-image.yaml"
      - "cmd/fluent-watcher/fluentbit/**"
      - "cmd/fluent-watcher/hooks/**"
      - "pkg/filenotify/**"

env:
  DOCKER_REPO: 'kubesphere'
  DOCKER_IMAGE: 'fluent-bit'
  GITHUB_IMAGE: '${{ github.repository }}/fluent-bit'

permissions:
  contents: read
  packages: write

jobs:
  build-prod-image-metadata:
    runs-on: ubuntu-latest
    name: Build prod image metadata
    outputs:
      IMG_NAME: ${{ steps.set-outputs.outputs.IMAGE_NAME }}
      DOCKER_IMG_NAME: ${{ steps.set-outputs.outputs.DOCKER_IMG_NAME }}
      version: ${{ steps.image-metadata.outputs.version }}
      tags: ${{ steps.image-metadata.outputs.tags }}
      labels: ${{ steps.image-metadata.outputs.labels }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
            
      - name: docker metadata for building
        id: image-metadata
        uses: docker/metadata-action@v5
        with:
          images: "ghcr.io/${{ env.GITHUB_IMAGE }}"
          tags: |
            raw,latest
            type=ref,event=branch
            type=ref,event=pr
            type=ref,event=tag
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}

      - name: Set outputs
        id: set-outputs
        run: |
          echo "IMAGE_NAME=${{ env.GITHUB_IMAGE }}" >> $GITHUB_OUTPUT
          echo "DOCKER_IMG_NAME=${{env.DOCKER_REPO}}/${{ env.DOCKER_IMAGE }}" >> $GITHUB_OUTPUT

  build-debug-image-metadata:
    runs-on: ubuntu-latest
    name: Build debug image metadata
    outputs:
      IMG_NAME: ${{ steps.set-outputs.outputs.IMAGE_NAME }}
      DOCKER_IMG_NAME: ${{ steps.set-outputs.outputs.DOCKER_IMG_NAME }}
      version: ${{ steps.image-metadata.outputs.version }}
      tags: ${{ steps.image-metadata.outputs.tags }}
      labels: ${{ steps.image-metadata.outputs.labels }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: docker metadata
        id: image-metadata
        uses: docker/metadata-action@v5
        with:
          images: "ghcr.io/${{ env.GITHUB_IMAGE }}"
          flavor: |
            latest=false
            suffix=-debug
          tags: |
            raw,latest
            type=ref,event=branch
            type=ref,event=pr
            type=ref,event=tag
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
      
      - name: Set outputs
        id: set-outputs
        run: |
          echo "IMAGE_NAME=${{ env.GITHUB_IMAGE }}" >> $GITHUB_OUTPUT
          echo "DOCKER_IMG_NAME=${{env.DOCKER_REPO}}/${{ env.DOCKER_IMAGE }}" >> $GITHUB_OUTPUT

  build-FluentBit-prod-image:
    needs: 
      - build-prod-image-metadata
    runs-on: ubuntu-latest
    timeout-minutes: 30
    name: Build Fluent Bit prod image
    steps:
      - name: Install Go
        uses: actions/setup-go@v4
        with:
          go-version: 1.21

      - uses: actions/cache@v4
        with:
          path: ~/go/pkg/mod
          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}

      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@v3

      - name: Build and Push Image for Fluent Bit
        id: docker-build
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./cmd/fluent-watcher/fluentbit/Dockerfile
          push: true
          platforms: linux/amd64,linux/arm64
          tags: ${{ needs.build-prod-image-metadata.outputs.tags }}
          labels: ${{ needs.build-prod-image-metadata.outputs.labels }}

  build-FluentBit-debug-image:
    needs: 
      - build-debug-image-metadata
    runs-on: ubuntu-latest
    timeout-minutes: 30
    name: Build Fluent Bit debug image
    steps:
      - name: Install Go
        uses: actions/setup-go@v4
        with:
          go-version: 1.21

      - uses: actions/cache@v4
        with:
          path: ~/go/pkg/mod
          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}

      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@v3
      
      - name: Build and Push Fluent Bit Debug Image
        id: docker-build-debug
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./cmd/fluent-watcher/fluentbit/Dockerfile.debug
          push: true
          platforms: linux/amd64,linux/arm64
          tags: ${{ needs.build-debug-image-metadata.outputs.tags }}
          labels: ${{ needs.build-debug-image-metadata.outputs.labels }}

  scan-FluentBit-image:
    name: Scan prod image
    needs: 
      - build-prod-image-metadata
      - build-FluentBit-prod-image
    uses: ./.github/workflows/scan-docker-image-action.yaml
    with:
      source_image: "${{ needs.build-prod-image-metadata.outputs.IMG_NAME }}:${{ needs.build-prod-image-metadata.outputs.version }}"
      source_registry: ghcr.io
      platforms: "['linux/arm64', 'linux/amd64']"
    secrets:
      registry_username: ${{ github.actor }}
      registry_password: ${{ secrets.GITHUB_TOKEN }}
  
  release-prod-image-to-docker-hub:
    if: ${{ github.event_name != 'pull_request' }}
    name: Release prod image to Docker Hub
    uses: ./.github/workflows/clone-docker-image-action.yaml
    needs: 
      - build-FluentBit-prod-image
      - scan-FluentBit-image
      - build-prod-image-metadata
    with:
      source_image: "${{ needs.build-prod-image-metadata.outputs.IMG_NAME }}:${{ needs.build-prod-image-metadata.outputs.version }}"
      source_registry: ghcr.io
      target_image: "${{ needs.build-prod-image-metadata.outputs.DOCKER_IMG_NAME }}"
      target_registry: docker.io
      platforms: "['linux/arm64', 'linux/amd64']"
      is_latest: true
    secrets:
      source_registry_username:  ${{ github.actor }}
      source_registry_token: ${{ secrets.GITHUB_TOKEN }}
      target_registry_username: ${{ secrets.REGISTRY_USER }}
      target_registry_token: ${{ secrets.REGISTRY_PASSWORD }}

  release-debug-image-to-docker-hub:
    if: ${{ github.event_name != 'pull_request' }}
    name: Release debug image to Docker Hub
    uses: ./.github/workflows/clone-docker-image-action.yaml
    needs: 
      - build-FluentBit-debug-image
      - build-debug-image-metadata
    with:
      source_image: "${{ needs.build-debug-image-metadata.outputs.IMG_NAME }}:${{ needs.build-debug-image-metadata.outputs.version }}"
      source_registry: ghcr.io
      target_image: "${{ needs.build-debug-image-metadata.outputs.DOCKER_IMG_NAME }}"
      target_registry: docker.io
      platforms: "['linux/arm64', 'linux/amd64']"
      is_latest: false
      suffix: "-debug"
    secrets:
      source_registry_username:  ${{ github.actor }}
      source_registry_token: ${{ secrets.GITHUB_TOKEN }}
      target_registry_username: ${{ secrets.REGISTRY_USER }}
      target_registry_token: ${{ secrets.REGISTRY_PASSWORD }}