base-build.yml

---
    name: build-beardy-base
    on:
      pull_request:
        branches:
          - main
      schedule:
        - cron: '05 10 * * *'  # 10:05am UTC everyday
      push:
        branches:
          - main
        paths-ignore:
          - '**/README.md'
      workflow_dispatch:
    
    env:
      IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}"  # do not edit
    
    concurrency:
      group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
      cancel-in-progress: true
    
    jobs:
      build_push:
        name: Build and push image
        runs-on: ubuntu-24.04
    
        permissions:
          contents: read
          packages: write
          id-token: write

        strategy:
          fail-fast: false # stop GH from cancelling all matrix builds if one fails
          matrix:
            include:
              - base: bootc
                containerfile: variants/bootc/Containerfile
                contextdir: variants/bootc/
                name: "${{ github.event.repository.name }}-bootc"  # the name of the image produced by this build, matches repo name appended with '-bootc'
                description: "bootc-based base image for bearded developers"

              - base: ublue
                containerfile: variants/ublue/Containerfile
                contextdir: variants/ublue
                name: "${{ github.event.repository.name }}-ublue"  # the name of the image produced by this build, matches repo name appended with '-ublue'
                description: "ublue-based base image for bearded developers"
        steps:
          - name: Checkout repo
            uses: actions/checkout@v4
    
          - name: Maximize build space
            uses: ublue-os/remove-unwanted-software@v7
    
          - name: Generate tags
            id: generate-tags
            shell: bash
            run: |
              # Generate a timestamp for creating an image version history
              TIMESTAMP="$(date +%Y%m%d)"
              COMMIT_TAGS=()
              BUILD_TAGS=()
    
              # Have tags for tracking builds during pull request
              SHA_SHORT="${GITHUB_SHA::7}"
              COMMIT_TAGS+=("pr-${{ github.event.number }}")
              COMMIT_TAGS+=("${SHA_SHORT}")
    
              # Append matching timestamp tags to keep a version history
              for TAG in "${BUILD_TAGS[@]}"; do
                  BUILD_TAGS+=("${TAG}-${TIMESTAMP}")
              done
    
              BUILD_TAGS+=("${TIMESTAMP}")
              BUILD_TAGS+=("latest")
    
              if [[ "${{ github.event_name }}" == "pull_request" ]]; then
                  echo "Generated the following commit tags: "
                  for TAG in "${COMMIT_TAGS[@]}"; do
                      echo "${TAG}"
                  done
    
                  alias_tags=("${COMMIT_TAGS[@]}")
              else
                  alias_tags=("${BUILD_TAGS[@]}")
              fi
    
              echo "Generated the following build tags: "
              for TAG in "${BUILD_TAGS[@]}"; do
                  echo "${TAG}"
              done
    
              echo "alias_tags=${alias_tags[*]}" >> $GITHUB_OUTPUT
    
          # Build metadata
          - name: Image Metadata
            uses: docker/metadata-action@v5
            id: meta
            with:
              images: |
                ${{ matrix.name }}
    
              labels: |
                io.artifacthub.package.readme-url=https://raw.githubusercontent.com/${{ github.repository }}/main/README.md
                org.opencontainers.image.description=${{ matrix.description }}
                org.opencontainers.image.title=${{ matrix.name }}
    
          # Build image using Buildah action
          - name: Build Image
            id: build_image
            uses: redhat-actions/buildah-build@v2
            with:
              context: ${{ matrix.contextdir }}
              containerfiles: |
                ./${{ matrix.containerfile }}
              # Postfix image name with -custom to make it a little more descriptive
              # Syntax: https://docs.github.com/en/actions/learn-github-actions/expressions#format
              image: ${{ matrix.name }}
              tags: |
                ${{ steps.generate-tags.outputs.alias_tags }}
              labels: ${{ steps.meta.outputs.labels }}
              oci: false
    
          # Workaround bug where capital letters in your GitHub username make it impossible to push to GHCR.
          # https://github.com/macbre/push-to-ghcr/issues/12
          - name: Lowercase Registry
            id: registry_case
            uses: ASzc/change-string-case-action@v6
            with:
              string: ${{ env.IMAGE_REGISTRY }}
    
          - name: Login to GitHub Container Registry
            uses: docker/login-action@v3
            with:
              registry: ghcr.io
              username: ${{ github.actor }}
              password: ${{ secrets.GITHUB_TOKEN }}
    
          - name: Push Image to GHCR
            uses: redhat-actions/push-to-registry@v2
            id: push
            env:
              REGISTRY_USER: ${{ github.actor }}
              REGISTRY_PASSWORD: ${{ github.token }}
            with:
              image: ${{ steps.build_image.outputs.image }}
              tags: ${{ steps.build_image.outputs.tags }}
              registry: ${{ steps.registry_case.outputs.lowercase }}
              username: ${{ env.REGISTRY_USER }}
              password: ${{ env.REGISTRY_PASSWORD }}
              extra-args: |
                --compression-format=zstd
    
          # This section is optional and only needs to be enabled if you plan on distributing
          # your project for others to consume. You will need to create a public and private key
          # using Cosign and save the private key as a repository secret in Github for this workflow
          # to consume. For more details, review the image signing section of the README.
    
          # Sign container
          - uses: sigstore/cosign-installer@v3.7.0
            if: github.event_name != 'pull_request'
    
          - name: Sign container image
            if: github.event_name != 'pull_request'
            run: |
              cosign sign -y --key env://COSIGN_PRIVATE_KEY ${{ steps.registry_case.outputs.lowercase }}/${{ steps.build_image.outputs.image }}@${TAGS}
            env:
              TAGS: ${{ steps.push.outputs.digest }}
              COSIGN_EXPERIMENTAL: false
              COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}