wsl-docker.yml

name: Build Ubuntu WSL Docker image

on:
  schedule:
    # update once a week
    - cron: "0 0 * * SUN"
  push:
    branches:
      - main
    paths:
      - .github/workflows/wsl-docker.yml
  pull_request:
    branches:
      - main
    paths:
      - .github/workflows/wsl-docker.yml
  workflow_dispatch:

permissions: {}

defaults:
  run:
    shell: bash

jobs:
  build-wsl:
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    permissions:
      packages: write # for GitHub Package Registry

    env:
      REGISTRY: ghcr.io
      IMAGE_NAME: ${{ github.repository }}/wsl

    steps:
      - name: Get Ubuntu WSL build info
        id: info
        run: |
          serial=$(curl --fail-with-body --location https://cloud-images.ubuntu.com/wsl/noble/current/unpacked/build-info.txt \
            | grep --only-matching --perl-regexp 'SERIAL=\K\d+')
          echo "serial=${serial}" >> "${GITHUB_OUTPUT}"

      - name: Get latest Ubuntu WSL image tag
        id: latest-tag
        # %2F is the URL-encoded form of /
        # get the serial tag of the latest image
        # cspell:ignore fwsl
        run: |
          latest_serial=$(gh api --header "Accept: application/vnd.github+json" --header "X-GitHub-Api-Version: 2022-11-28" \
            /user/packages/container/${{ github.event.repository.name }}%2Fwsl/versions \
            --jq '.[] | select(.metadata.container.tags | contains(["latest"])) | .metadata.container.tags[] | select(. != "latest")')
          echo "latest_serial=${latest_serial}" >> "${GITHUB_OUTPUT}"
        env:
          GITHUB_TOKEN: ${{ github.token }}
        # 404 error for the first run
        continue-on-error: true

      # cspell:ignore rootfs
      - name: Download Ubuntu WSL rootfs
        id: rootfs
        # skip if the latest image is already created
        if: ${{ steps.info.outputs.serial != steps.latest-tag.outputs.latest_serial }}
        run: |
          curl --fail-with-body --location --output ubuntu.tar.gz \
            https://cloud-images.ubuntu.com/wsl/noble/current/ubuntu-noble-wsl-amd64-ubuntu.rootfs.tar.gz

      - name: Create Dockerfile
        if: ${{ steps.rootfs.outcome != 'skipped' }}
        run: |
          cat <<EOF > Dockerfile
          FROM scratch
          ADD ubuntu.tar.gz /
          EOF

      - name: Login to GitHub Container Registry
        if: ${{ steps.rootfs.outcome != 'skipped' }}
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ github.token }}

      # cspell:ignore buildx
      - name: Setup Buildx
        if: ${{ steps.rootfs.outcome != 'skipped' }}
        uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3.7.1

      - name: Build and push Docker image
        id: push
        if: ${{ steps.rootfs.outcome != 'skipped' }}
        uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75 # v6.9.0
        with:
          context: .
          push: ${{ github.event_name != 'pull_request' }}
          # avoid image without manifest created
          # ref: https://github.com/docker/build-push-action/issues/900
          provenance: false
          tags: |
            ghcr.io/${{ env.IMAGE_NAME }}:${{ steps.info.outputs.serial }}
            ghcr.io/${{ env.IMAGE_NAME }}:latest
          cache-from: type=gha
          cache-to: type=gha,mode=max

  actions-timeline:
    needs:
      - build-wsl
    if: ${{ !cancelled() }}

    runs-on: ubuntu-24.04
    timeout-minutes: 5
    permissions:
      actions: read # for actions-timeline

    steps:
      - name: actions-timeline
        # cspell:ignore kesin
        uses: Kesin11/actions-timeline@3046833d9aacfd7745c5264b7f3af851c3e2a619 # v2.2.1