collector.yml

name: Collector image build

on:
  workflow_call:
    inputs:
      collector-tag:
        type: string
        required: true
        description: |
          The tag used to build the collector image
      collector-image:
        type: string
        required: true
        description: |
          Basic stackrox-io image built
      collector-builder-tag:
        type: string
        required: true
        description: |
          The builder tag to use in the build

env:
  COLLECTOR_TAG: ${{ inputs.collector-tag }}
  COLLECTOR_BUILDER_TAG: ${{ inputs.collector-builder-tag }}
  RHACS_ENG_IMAGE: quay.io/rhacs-eng/collector:${{ inputs.collector-tag }}
  ANSIBLE_CONFIG: ${{ github.workspace }}/ansible/ansible.cfg
  TRACE_SINSP_EVENTS: ${{ github.event_name == 'pull_request' }}
  ADDRESS_SANITIZER: ${{ contains(github.event.pull_request.labels.*.name, 'address-sanitizer') }}

jobs:
  build-collector-image:
    name: Build Collector
    runs-on: ubuntu-24.04
    strategy:
      fail-fast: false
      matrix:
        arch: [amd64, ppc64le, arm64]

    env:
      PLATFORM: linux/${{ matrix.arch }}
      CONTEXT_DRIVERS_DIR: ${{ github.workspace }}/collector/kernel-modules

    steps:
      - uses: actions/checkout@v4
        with:
          submodules: true

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Create ansible vars
        run: |
          cat << EOF > ${{ github.workspace }}/ansible/secrets.yml
          ---
          stackrox_io_username: ${{ secrets.QUAY_STACKROX_IO_RW_USERNAME }}
          stackrox_io_password: ${{ secrets.QUAY_STACKROX_IO_RW_PASSWORD }}
          rhacs_eng_username: ${{ secrets.QUAY_RHACS_ENG_RW_USERNAME }}
          rhacs_eng_password: ${{ secrets.QUAY_RHACS_ENG_RW_PASSWORD }}
          collector_git_ref: ${{ github.ref }}
          collector_builder_tag: ${{ env.COLLECTOR_BUILDER_TAG }}
          disable_profiling: ${{ matrix.arch != 'amd64' && matrix.arch != 'arm64' }}
          rhacs_eng_image: ${{ env.RHACS_ENG_IMAGE }}
          collector_image: ${{ inputs.collector-image }}
          collector_tag: ${{ inputs.collector-tag }}
          debug_mode: ${{ github.event_name == 'pull_request' }}
          driver_version: ${DRIVER_VERSION}
          EOF

      - name: Build images
        if: |
          github.event_name != 'pull_request' ||
          matrix.arch == 'amd64' ||
          contains(github.event.pull_request.labels.*.name, 'run-multiarch-builds')
        timeout-minutes: 480
        run: |
          ansible-playbook \
            --connection local \
            -i localhost, \
            --limit localhost \
            -e arch='${{ matrix.arch }}' \
            -e @'${{ github.workspace }}/ansible/secrets.yml' \
            ansible/ci-build-collector.yml

  build-collector-image-remote-vm:
    name: Build Collector on a remote VM
    runs-on: ubuntu-24.04
    if: github.event_name != 'pull_request' || contains(github.event.pull_request.labels.*.name, 'run-multiarch-builds')
    strategy:
      fail-fast: false
      matrix:
        arch: [s390x]

    env:
      PLATFORM: linux/${{ matrix.arch }}

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: "3.10"

      - uses: 'google-github-actions/auth@v2'
        with:
          credentials_json: '${{ secrets.GOOGLE_CREDENTIALS_COLLECTOR_SVC_ACCT }}'

      - uses: 'google-github-actions/setup-gcloud@v2'

      - uses: ./.github/actions/setup-vm-creds
        with:
          gcp-ssh-key: ${{ secrets.GCP_SSH_KEY }}
          gcp-ssh-key-pub: ${{ secrets.GCP_SSH_KEY_PUB }}
          s390x-ssh-key: ${{ secrets.IBM_CLOUD_S390X_SSH_PRIVATE_KEY }}
          ppc64le-ssh-key: ${{ secrets.IBM_CLOUD_POWER_SSH_PRIVATE_KEY }}
          ppc64le-ssh-key-pub: ${{ secrets.IBM_CLOUD_POWER_SSH_PUBLIC_KEY }}
          s390x-key: ${{ secrets.IBM_CLOUD_S390x_API_KEY }}
          ppc64le-key: ${{ secrets.IBM_CLOUD_POWER_API_KEY }}
          redhat-username: ${{ secrets.REDHAT_USERNAME }}
          redhat-password: ${{ secrets.REDHAT_PASSWORD }}
          vm-type: rhel-${{ matrix.arch }}
          job-tag: builder

      - name: Create Build VMs
        run: |
          make -C "${{ github.workspace }}/ansible" create-build-vms

      - name: Create ansible vars
        run: |
          cat << EOF > ${{ github.workspace }}/ansible/secrets.yml
          ---
          stackrox_io_username: ${{ secrets.QUAY_STACKROX_IO_RW_USERNAME }}
          stackrox_io_password: ${{ secrets.QUAY_STACKROX_IO_RW_PASSWORD }}
          rhacs_eng_username: ${{ secrets.QUAY_RHACS_ENG_RW_USERNAME }}
          rhacs_eng_password: ${{ secrets.QUAY_RHACS_ENG_RW_PASSWORD }}
          collector_git_ref: ${{ github.ref }}
          collector_git_sha: ${{ github.sha }}
          collector_builder_tag: ${{ env.COLLECTOR_BUILDER_TAG }}
          disable_profiling: ${{ matrix.arch != 'amd64' && matrix.arch != 'arm64' }}
          rhacs_eng_image: ${{ env.RHACS_ENG_IMAGE }}
          collector_image: ${{ inputs.collector-image }}
          collector_tag: ${{ inputs.collector-tag }}
          debug_mode: ${{ github.event_name == 'pull_request' }}
          EOF

      - name: Build ${{ matrix.arch }} image
        timeout-minutes: 480
        run: |
          ansible-playbook \
            -i ansible/ci \
            -e arch='${{ matrix.arch }}' \
            -e build_hosts='job_id_${{ env.JOB_ID }}' \
            -e @'${{ github.workspace }}/ansible/secrets.yml' \
            ansible/ci-build-collector.yml

      - name: Destroy Build VMs
        if: always()
        run: |
          make -C ansible destroy-vms

  create-multiarch-manifest:
    needs:
    - build-collector-image
    - build-collector-image-remote-vm
    name: Create Multiarch manifest
    runs-on: ubuntu-24.04
    if: |
      github.event_name != 'pull_request' ||
      contains(github.event.pull_request.labels.*.name, 'run-multiarch-builds')
    env:
      ARCHS: amd64 ppc64le s390x arm64

    steps:
      - uses: actions/checkout@v4

      - name: Login to quay.io/stackrox-io
        uses: docker/login-action@v3
        with:
          registry: quay.io
          username: ${{ secrets.QUAY_STACKROX_IO_RW_USERNAME }}
          password: ${{ secrets.QUAY_STACKROX_IO_RW_PASSWORD }}

      - name: Create and push multiarch manifest for stackrox-io
        uses: ./.github/actions/create-multiarch-manifest
        with:
          base-image: quay.io/stackrox-io/collector:${{ inputs.collector-tag }}
          archs: ${{ env.ARCHS }}

      - name: Create and push multiarch manifest for stackrox-io -slim
        uses: ./.github/actions/create-multiarch-manifest
        with:
          base-image: quay.io/stackrox-io/collector:${{ inputs.collector-tag }}
          archs: ${{ env.ARCHS }}
          suffix: -slim

      - name: Create and push multiarch manifest for stackrox-io -base
        uses: ./.github/actions/create-multiarch-manifest
        with:
          base-image: quay.io/stackrox-io/collector:${{ inputs.collector-tag }}
          archs: ${{ env.ARCHS }}
          suffix: -base

      - name: Create and push multiarch manifest for stackrox-io -latest
        uses: ./.github/actions/create-multiarch-manifest
        with:
          base-image: quay.io/stackrox-io/collector:${{ inputs.collector-tag }}
          archs: ${{ env.ARCHS }}
          suffix: -latest

      - name: Login to quay.io/rhacs-eng
        uses: docker/login-action@v3
        with:
          registry: quay.io
          username: ${{ secrets.QUAY_RHACS_ENG_RW_USERNAME }}
          password: ${{ secrets.QUAY_RHACS_ENG_RW_PASSWORD }}

      - name: Create and push multiarch manifest for rhacs-eng
        uses: ./.github/actions/create-multiarch-manifest
        with:
          base-image: quay.io/rhacs-eng/collector:${{ inputs.collector-tag }}
          archs: ${{ env.ARCHS }}

      - name: Create and push multiarch manifest for rhacs-eng -slim
        uses: ./.github/actions/create-multiarch-manifest
        with:
          base-image: quay.io/rhacs-eng/collector:${{ inputs.collector-tag }}
          archs: ${{ env.ARCHS }}
          suffix: -slim

      - name: Create and push multiarch manifest for rhacs-eng -base
        uses: ./.github/actions/create-multiarch-manifest
        with:
          base-image: quay.io/rhacs-eng/collector:${{ inputs.collector-tag }}
          archs: ${{ env.ARCHS }}
          suffix: -base

      - name: Create and push multiarch manifest for rhacs-eng -latest
        uses: ./.github/actions/create-multiarch-manifest
        with:
          base-image: quay.io/rhacs-eng/collector:${{ inputs.collector-tag }}
          archs: ${{ env.ARCHS }}
          suffix: -latest

  retag-x86-image:
    needs:
    - build-collector-image
    name: Retag x86 slim image
    runs-on: ubuntu-24.04
    if: |
      github.event_name == 'pull_request' &&
      !contains(github.event.pull_request.labels.*.name, 'run-multiarch-builds')
    steps:
      - name: Pull image to retag
        run: |
          docker pull ${{ inputs.collector-image }}-amd64

      - name: Retag and push stackrox-io
        uses: stackrox/actions/images/retag-and-push@v1
        with:
          src-image: ${{ inputs.collector-image }}-amd64
          dst-image: ${{ inputs.collector-image }}
          username: ${{ secrets.QUAY_STACKROX_IO_RW_USERNAME }}
          password: ${{ secrets.QUAY_STACKROX_IO_RW_PASSWORD }}

      - name: Retag and push stackrox-io -slim
        uses: stackrox/actions/images/retag-and-push@v1
        with:
          src-image: ${{ inputs.collector-image }}-amd64
          dst-image: ${{ inputs.collector-image }}-slim
          username: ${{ secrets.QUAY_STACKROX_IO_RW_USERNAME }}
          password: ${{ secrets.QUAY_STACKROX_IO_RW_PASSWORD }}

      - name: Retag and push stackrox-io -base
        uses: stackrox/actions/images/retag-and-push@v1
        with:
          src-image: ${{ inputs.collector-image }}-amd64
          dst-image: ${{ inputs.collector-image }}-base
          username: ${{ secrets.QUAY_STACKROX_IO_RW_USERNAME }}
          password: ${{ secrets.QUAY_STACKROX_IO_RW_PASSWORD }}

      - name: Retag and push stackrox-io -latest
        uses: stackrox/actions/images/retag-and-push@v1
        with:
          src-image: ${{ inputs.collector-image }}-amd64
          dst-image: ${{ inputs.collector-image }}-latest
          username: ${{ secrets.QUAY_STACKROX_IO_RW_USERNAME }}
          password: ${{ secrets.QUAY_STACKROX_IO_RW_PASSWORD }}

      - name: Retag and push rhacs-eng
        uses: stackrox/actions/images/retag-and-push@v1
        with:
          src-image: ${{ inputs.collector-image }}-amd64
          dst-image: ${{ env.RHACS_ENG_IMAGE }}
          username: ${{ secrets.QUAY_RHACS_ENG_RW_USERNAME }}
          password: ${{ secrets.QUAY_RHACS_ENG_RW_PASSWORD }}

      - name: Retag and push rhacs-eng -slim
        uses: stackrox/actions/images/retag-and-push@v1
        with:
          src-image: ${{ inputs.collector-image }}-amd64
          dst-image: ${{ env.RHACS_ENG_IMAGE }}-slim
          username: ${{ secrets.QUAY_RHACS_ENG_RW_USERNAME }}
          password: ${{ secrets.QUAY_RHACS_ENG_RW_PASSWORD }}

      - name: Retag and push rhacs-eng -base
        uses: stackrox/actions/images/retag-and-push@v1
        with:
          src-image: ${{ inputs.collector-image }}-amd64
          dst-image: ${{ env.RHACS_ENG_IMAGE }}-base
          username: ${{ secrets.QUAY_RHACS_ENG_RW_USERNAME }}
          password: ${{ secrets.QUAY_RHACS_ENG_RW_PASSWORD }}

      - name: Retag and push rhacs-eng -latest
        uses: stackrox/actions/images/retag-and-push@v1
        with:
          src-image: ${{ inputs.collector-image }}-amd64
          dst-image: ${{ env.RHACS_ENG_IMAGE }}-latest
          username: ${{ secrets.QUAY_RHACS_ENG_RW_USERNAME }}
          password: ${{ secrets.QUAY_RHACS_ENG_RW_PASSWORD }}