docker.yml

name: Docker

on:
  workflow_call:
    inputs:
      tag:
        required: true
        type: string
      platforms:
        required: true
        type: string
      assert:
        type: boolean
        default: false
      flow_name:
        required: true
        type: string
      trail_name:
        required: true
        type: string
      kosli_org:
        required: true
        type: string
      checkout_ref:
        required: false
        type: string
        default: ''
      report_to_kosli:
        required: false
        type: string
        default: 'none'
    secrets:
      slack_channel:
        required: true
      slack_webhook:
        required: true
      kosli_api_token:
        required: true
      snyk_token:
        required: true


env:
  IMAGE: ghcr.io/kosli-dev/cli
  # KOSLI_DRY_RUN: "True"
  # Ordinarily we declare KOSLI_ORG and KOSLI_FLOW here but
  # this interferes with the CLI integration tests


jobs:
  # ---------------------------------------------------------------------------
  # Job 1: Resolve the platforms input into a JSON matrix.
  #
  # Why a separate job: workflow-level matrix entries must be static or come
  # from job outputs; they cannot be computed inline from an input string.
  #
  # To support a new platform, add one entry to RUNNER_MAP below.
  # ---------------------------------------------------------------------------
  prepare:
    name: Prepare build matrix
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
        with:
          egress-policy: audit

      - name: Build matrix JSON from platforms input
        id: set-matrix
        env:
          PLATFORMS: ${{ inputs.platforms }}
          RUNNER_MAP: |
            {
              "linux/amd64": "ubuntu-latest",
              "linux/arm64": "ubuntu-24.04-arm"
            }
        run: |
          MATRIX=$(echo "$PLATFORMS" \
            | tr ',' '\n' \
            | jq -Rsc --argjson map "$RUNNER_MAP" '
                split("\n") |
                map(select(length > 0) | ltrimstr(" ") | rtrimstr(" ")) |
                map(
                  . as $p |
                  if ($map | has($p)) then {
                    platform: $p,
                    runner:   $map[$p],
                    slug:     ($p | gsub("/"; "-"))
                  } else
                    error("Unsupported platform \($p). Add it to RUNNER_MAP in docker.yml.")
                  end
                )
              ')
          echo "matrix=$MATRIX" >> $GITHUB_OUTPUT


  # ---------------------------------------------------------------------------
  # Job 2: Build each platform on its native runner, push by digest.
  #
  # Native runners: building linux/arm64 via QEMU on an amd64 runner is
  # 5-10x slower than running it natively. Each leg pushes its image by digest
  # (not by tag) so the two images live in the registry without overwriting
  # each other. Digests are passed to the merge job via artifacts.
  # ---------------------------------------------------------------------------
  build:
    name: Docker Build (${{ matrix.platform }})
    needs: [prepare]
    runs-on: ${{ matrix.runner }}
    permissions:
      id-token: write
      contents: read
      packages: write

    strategy:
      fail-fast: false
      matrix:
        include: ${{ fromJson(needs.prepare.outputs.matrix) }}

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
        with:
          egress-policy: audit

      - uses: actions/checkout@v6
        with:
          fetch-depth: 3
          ref: ${{ inputs.checkout_ref || github.sha }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4
        # No QEMU needed — each runner is already native for its platform

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push by digest
        id: build
        uses: docker/build-push-action@v7
        with:
          context: .
          # Push without a tag — the merge job creates the final manifest.
          platforms: ${{ matrix.platform }}
          outputs: type=image,name=${{ env.IMAGE }},push-by-digest=true,name-canonical=true,push=true
          # Per-arch cache keeps amd64 and arm64 independent so a change on
          # one arch doesn't bust the other's cache.
          cache-from: type=registry,ref=${{ env.IMAGE }}:buildcache-${{ matrix.slug }}
          cache-to: type=registry,ref=${{ env.IMAGE }}:buildcache-${{ matrix.slug }},mode=max

      - name: Export digest to file
        run: |
          if [ -z "$DIGEST" ]; then echo "::error::Build digest is empty"; exit 1; fi
          mkdir -p /tmp/digests
          touch "/tmp/digests/${DIGEST#sha256:}"
        env:
          DIGEST: ${{ steps.build.outputs.digest }}

      - name: Upload digest artifact
        uses: actions/upload-artifact@v7
        with:
          name: digest-${{ matrix.slug }}
          path: /tmp/digests/*
          if-no-files-found: error
          retention-days: 1


  # ---------------------------------------------------------------------------
  # Job 3: Merge per-arch digests into a single manifest, then run all
  # post-build steps (SBOM, Snyk, Kosli attestation, smoke test) once.
  # ---------------------------------------------------------------------------
  merge:
    name: Docker Merge & Attest
    runs-on: ubuntu-latest
    needs: [build]
    permissions:
      id-token: write
      contents: write
      attestations: write
      packages: write
      artifact-metadata: write

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
        with:
          egress-policy: audit

      - uses: actions/checkout@v6
        with:
          fetch-depth: 3
          ref: ${{ inputs.checkout_ref || github.sha }}

      - uses: actions/setup-go@v6
        with:
          go-version-file: '.go-version'
          check-latest: true

      - name: Download all digest artifacts
        uses: actions/download-artifact@v7
        with:
          path: /tmp/digests
          pattern: digest-*
          merge-multiple: true

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: setup-kosli-cli
        uses: kosli-dev/setup-cli-action@v3
        with:
          version: ${{ vars.KOSLI_CLI_VERSION }}

      - name: Create manifest and push
        id: docker_build
        env:
          IMAGE: ${{ env.IMAGE }}
          TAG: ${{ inputs.tag }}
        run: |
          # Read only files that look like sha256 hex digests — guards against
          # any stray files that might land in /tmp/digests unexpectedly.
          DIGEST_ARGS=$(find /tmp/digests -maxdepth 1 -type f \
            | grep -E '/[0-9a-f]{64}$' \
            | xargs -I{} basename {} \
            | sed "s|^|${IMAGE}@sha256:|" \
            | xargs)

          if [ -z "$DIGEST_ARGS" ]; then
            echo "::error::No valid digest files found in /tmp/digests"
            exit 1
          fi

          docker buildx imagetools create \
            --tag "${IMAGE}:${TAG}" \
            ${DIGEST_ARGS}

          DIGEST=$(docker buildx imagetools inspect "${IMAGE}:${TAG}" \
            --format '{{json .Manifest.Digest}}' | tr -d '"')
          echo "digest=${DIGEST}" >> $GITHUB_OUTPUT

      - name: Make the image fingerprint available for following steps
        env:
          BUILD_DIGEST: ${{ steps.docker_build.outputs.digest }}
        run: |
          ARTIFACT_SHA=$(echo "${BUILD_DIGEST}" | sed 's/.*://')
          echo "FINGERPRINT=$ARTIFACT_SHA" >> ${GITHUB_ENV}

      - name: Attest Build Provenance
        uses: actions/attest@v4
        with:
          subject-name: ${{ env.IMAGE }}
          subject-digest: ${{ steps.docker_build.outputs.digest }}
          push-to-registry: true

      - name: Generate SBOM for the docker image
        uses: anchore/sbom-action@v0
        with:
          image: ${{ env.IMAGE }}:${{ inputs.tag }}
          format: 'spdx-json'
          output-file: 'sbom.spdx.json'
          upload-artifact: false

      - name: Attest SBOM to Github
        uses: actions/attest@v4
        with:
          sbom-path: 'sbom.spdx.json'
          subject-name: ${{ env.IMAGE }}
          subject-digest: ${{ steps.docker_build.outputs.digest }}
          push-to-registry: true

      - name: setup Snyk
        uses: snyk/actions/setup@master

      - name: Report Docker image to Kosli
        if: ${{ inputs.report_to_kosli != 'none' }}
        env:
          KOSLI_API_TOKEN: ${{ secrets.kosli_api_token }}
        run:
          kosli attest artifact
             ${{ env.IMAGE }}:${{ inputs.tag }}
             --flow ${{ inputs.flow_name }}
             --trail ${{ inputs.trail_name }}
             --name cli-docker
             --fingerprint ${{ env.FINGERPRINT }}
             --external-url sigstore=https://search.sigstore.dev/?hash=${{ env.FINGERPRINT }}
             --org ${{ inputs.kosli_org }}

      - name: Report SBOM to Kosli
        if: ${{ inputs.report_to_kosli != 'none' }}
        env:
          KOSLI_API_TOKEN: ${{ secrets.kosli_api_token }}
        run:
          kosli attest generic
            --flow ${{ inputs.flow_name }}
            --trail ${{ inputs.trail_name }}
            --name container-sbom
            --fingerprint ${{ env.FINGERPRINT }}
            --attachments sbom.spdx.json
            --org ${{ inputs.kosli_org }}

      - name: Run Snyk Container Test to scan the Docker image for vulnerabilities
        env:
          SNYK_TOKEN: ${{ secrets.snyk_token }}
        run:
          snyk container test ${{ env.IMAGE }}:${{ inputs.tag }}
             --file=Dockerfile
             --sarif
             --policy-path=.snyk
             --sarif-file-output=snyk-docker.json

      - name: Report Snyk Docker scan results attestation to Kosli
        if: ${{ inputs.report_to_kosli != 'none' && (success() || failure()) }}
        env:
          KOSLI_API_TOKEN: ${{ secrets.kosli_api_token }}
        run:
          kosli attest snyk
              --flow ${{ inputs.flow_name }}
              --trail ${{ inputs.trail_name }}
              --fingerprint ${{ env.FINGERPRINT }}
              --name snyk-container-test
              --scan-results snyk-docker.json
              --org ${{ inputs.kosli_org }}

      - name: Smoke test the docker image to be sure it can connect to Kosli
        id: smoke-test
        env:
          KOSLI_ORG: cyber-dojo
          KOSLI_API_TOKEN: any-token-will-do
        run:
          docker run -e KOSLI_API_TOKEN
            -e KOSLI_ORG --rm ${{ env.IMAGE }}:${{ inputs.tag }}
            list environments

      - name: Report Docker smoke test attestation to Kosli
        if: ${{ inputs.report_to_kosli != 'none' && (success() || failure()) }}
        env:
          KOSLI_API_TOKEN: ${{ secrets.kosli_api_token }}
          SMOKE_TEST_OUTCOME: ${{ steps.smoke-test.outcome }}
        run:
          kosli attest generic
              --flow ${{ inputs.flow_name }}
              --trail ${{ inputs.trail_name }}
              --fingerprint ${{ env.FINGERPRINT }}
              --name smoke-test
              --compliant=${{ steps.smoke-test.outcome == 'success' }}
              --org ${{ inputs.kosli_org }}