vib-build.yml

name: Vib Build

on:
  push:
    branches:
      - 'dev'
    tags:
      - '*'
  workflow_dispatch:
  pull_request:

env:
  BUILDX_NO_DEFAULT_ATTESTATIONS: 1

permissions:
    contents: write # Allow actions to create release
    packages: write # Allow pushing images to GHCR
    attestations: write # To create and write attestations
    id-token: write # Additional permissions for the persistence of the attestations

jobs:
  build:
    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@v4
    
    - name: Install debootstrap from Ubuntu git
      run: |
          sudo git clone --depth 1 https://git.launchpad.net/ubuntu/+source/debootstrap /debootstrap
          sudo chmod a+x /debootstrap/debootstrap
          sudo ln -s /debootstrap/debootstrap -t /usr/local/bin

    - name: Replace testing repository with production
      if: ${{ github.ref_type == 'tag' }}
      run: |
        sed 's|http://testing.vanillaos.org|http://repo2.vanillaos.org|g' -i rootfs/build.sh
        sed 's|http://testing.vanillaos.org|http://repo2.vanillaos.org|g' -i rootfs/includes.rootfs/etc/apt/sources.list.d/vanilla-base.sources

    - name: Rootfs
      working-directory: rootfs
      run: |
        sudo apt install -y podman
        sudo sh build.sh

    - uses: vanilla-os/vib-gh-action@v0.8.1

    - name: Generate image name
      run: |
        REPO_OWNER_LOWERCASE="$(echo ${{ github.repository_owner }} | tr '[:upper:]' '[:lower:]')"
        echo "REPO_OWNER_LOWERCASE=$REPO_OWNER_LOWERCASE" >> "$GITHUB_ENV"
        echo "IMAGE_URL=ghcr.io/$REPO_OWNER_LOWERCASE/pico" >> "$GITHUB_ENV"

    - name: Extra image tag branch
      if: ${{ github.ref_type != 'tag' }}
      run: |
        echo "EXTRA_TAG=ref,event=branch" >> "$GITHUB_ENV"

    - name: Extra image tag release
      if: ${{ github.ref_type == 'tag' }}
      run: |
        echo "EXTRA_TAG=raw,main" >> "$GITHUB_ENV"

    - name: Docker meta
      id: docker_meta
      uses: docker/metadata-action@v5
      with:
        images: |
          ${{ env. IMAGE_URL }}
        tags: |
          type=semver,pattern={{version}}
          type=semver,pattern={{major}}.{{minor}}
          type=semver,pattern={{raw}}
          type=semver,pattern=v{{major}}
          type=${{ env.EXTRA_TAG }}

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3

    - name: Login to GitHub Package Registry
      uses: docker/login-action@v3
      if: ${{ github.event_name != 'pull_request' }}
      with:
        registry: ghcr.io
        username: ${{ github.repository_owner }}
        password: ${{ secrets.GITHUB_TOKEN }}

    - name: Build and Push the Docker image
      id: push
      uses: docker/build-push-action@v6
      with:
        context: .
        file: Containerfile
        push: ${{ github.event_name != 'pull_request' }}
        tags: ${{ steps.docker_meta.outputs.tags }}
        labels: ${{ steps.docker_meta.outputs.labels }}
        cache-from: type=gha
        cache-to: type=gha,mode=max
        platforms: linux/amd64
        provenance: false
    
    - name: Attest pushed image
      uses: actions/attest-build-provenance@v1
      id: attest
      if: ${{ github.event_name != 'pull_request' }}
      with:
        subject-name: ${{ env.IMAGE_URL }}
        subject-digest: ${{ steps.push.outputs.digest }}
        push-to-registry: false

    - name: Create Checksum
      working-directory: rootfs
      run: |
        sha256sum vanilla-pico.tar.gz > checksum.txt

    - uses: actions/upload-artifact@v4
      with:
        name: vanilla-pico-rootfs
        path: rootfs/vanilla-pico.tar.zst

    - uses: softprops/action-gh-release@v2
      with:
        token: "${{ secrets.GITHUB_TOKEN }}"
        tag_name: "continuous"
        prerelease: true
        name: "Continuous Build"
        files: |
          rootfs/vanilla-pico.tar.gz
          rootfs/checksum.txt