build.yml

on:
  push:
    branches:
      - master
  pull_request:

permissions:
  contents: read
  security-events: write # upload Sarif results

name: Build
jobs:
  build-amd64:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Set the TAG value
      id: get-TAG
      run: |
        echo "$(make -s log | grep TAG)" >> "$GITHUB_ENV"

    - name: Build container operator image
      uses: docker/build-push-action@v6
      with:
        context: .
        build-args: ARCH=amd64
        push: false
        tags: rancher/hardened-sriov-network-operator:${{ env.TAG }}-amd64
        target: operator
        file: Dockerfile
        build-args: |
          TAG=${{ env.TAG }}

    - name: Build container config-daemon image
      uses: docker/build-push-action@v6
      with:
        context: .
        build-args: ARCH=amd64
        push: false
        tags: rancher/hardened-sriov-network-config-daemon:${{ env.TAG }}-amd64
        target: config-daemon
        file: Dockerfile
        build-args: |
          TAG=${{ env.TAG }}

    - name: Build container webhook image
      uses: docker/build-push-action@v6
      with:
        context: .
        build-args: ARCH=amd64
        push: false
        tags: rancher/hardened-sriov-network-webhook:${{ env.TAG }}-amd64
        target: webhook
        file: Dockerfile
        build-args: |
          TAG=${{ env.TAG }}
      
    - name: Run Trivy vulnerability scanner
      uses: aquasecurity/trivy-action@0.22.0
      with:
        image-ref: rancher/hardened-sriov-network-operator:${{ env.TAG }}-amd64
        ignore-unfixed: true
        vuln-type: 'os,library'
        severity: 'CRITICAL,HIGH'
        format: 'sarif'
        output: 'trivy-results.sarif'
    - name: Upload Trivy scan results to GitHub Security tab
      uses: github/codeql-action/upload-sarif@v3
      if: always()
      with:
        sarif_file: 'trivy-results.sarif'

  build-arm64:
    runs-on: ubuntu-latest
    steps:
    - name: Check out code
      uses: actions/checkout@v4

    - name: Set up QEMU
      uses: docker/setup-qemu-action@v3

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3

    - name: Set the TAG value
      id: get-TAG
      run: |
        echo "$(make -s log | grep TAG)" >> "$GITHUB_ENV"

    - name: Build container operator image
      uses: docker/build-push-action@v6
      with:
        context: .
        build-args: ARCH=arm64
        push: false
        tags: rancher/hardened-sriov-network-operator:${{ env.TAG }}-arm64
        target: operator
        file: Dockerfile
        build-args: |
          TAG=${{ env.TAG }}

    - name: Build container config-daemon image
      uses: docker/build-push-action@v6
      with:
        context: .
        build-args: ARCH=arm64
        push: false
        tags: rancher/hardened-sriov-network-config-daemon:${{ env.TAG }}-arm64
        target: config-daemon
        file: Dockerfile
        build-args: |
          TAG=${{ env.TAG }}

    - name: Build container webhook image
      uses: docker/build-push-action@v6
      with:
        context: .
        build-args: ARCH=arm64
        push: false
        tags: rancher/hardened-sriov-network-webhook:${{ env.TAG }}-arm64
        target: webhook
        file: Dockerfile
        build-args: |
          TAG=${{ env.TAG }}