name: Build

on:

workflow_dispatch:

inputs:

commit:

description: 'Commit SHA to build'

required: true

type: string

workflow_call:

push:

tags:

- '*-nightly-*'

branches:

- master

pull_request:

types:

- opened

- reopened

- synchronize

defaults:

run:

# This enables `-o pipefail` for all jobs as compared to when shell isn't set.

# See https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#defaultsrunshell

shell: bash

jobs:

define-job-matrix:

outputs:

matrix: ${{ steps.define-job-matrix.outputs.matrix }}

build-tag: ${{ steps.build-tag.outputs.tag }}

short-commit: ${{ steps.short-commit.outputs.shortcommit }}

gotags: ${{ steps.gotags.outputs.gotags }}

quay-tag-expiration: ${{ steps.quay-tag-expiration.outputs.expiration }}

runs-on: ubuntu-slim

steps:

- name: Checkout

uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0

with:

fetch-depth: 0

ref: ${{ inputs.commit || github.event.pull_request.head.sha }}

- uses: ./.github/actions/handle-tagged-build

- name: Compute build tag

id: build-tag

run: |

TAG=$(make --quiet --no-print-directory tag)

echo "tag=${TAG}" >> "$GITHUB_OUTPUT"

- name: Compute short commit

id: short-commit

run: |

SHORTCOMMIT=$(make --quiet --no-print-directory shortcommit)

echo "shortcommit=${SHORTCOMMIT}" >> "$GITHUB_OUTPUT"

- name: Compute GOTAGS

id: gotags

run: |

GOTAGS=""

if [[ "${GITHUB_REF}" =~ ^refs/tags/ ]]; then

# Tag builds (release or nightly) get release GOTAGS

GOTAGS="release"

fi

echo "gotags=${GOTAGS}" >> "$GITHUB_OUTPUT"

- name: Compute Quay tag expiration

id: quay-tag-expiration

run: |

EXPIRATION="13w"

if [[ "${GITHUB_REF}" =~ ^refs/tags/ ]]; then

# Tag builds (release or nightly) never expire

EXPIRATION="never"

fi

echo "expiration=${EXPIRATION}" >> "$GITHUB_OUTPUT"

- name: Define the matrix for build jobs

id: define-job-matrix

run: |

source './scripts/ci/lib.sh'

matrix='{

"pre_build_go_binaries": { "name":[], "arch":[] },

"build_and_push_main": { "name":[], "arch":[] },

"push_main_multiarch_manifests": { "name":[] },

"build_and_push_operator": { "name":[], "arch":[] },

"push_operator_multiarch_manifests": { "name":[] },

"build_and_push_scanner": { "name":[], "goos":[], "arch":[], "registry":[] },

"push_scanner_manifests": { "name":[], "registry":[] }

}'

# The base matrix

matrix="$(jq '.pre_build_go_binaries.name += ["default"]' <<< "$matrix")"

matrix="$(jq '.pre_build_go_binaries.arch += ["amd64", "arm64"]' <<< "$matrix")"

matrix="$(jq '.build_and_push_main.name += ["RHACS_BRANDING", "STACKROX_BRANDING"]' <<< "$matrix")"

matrix="$(jq '.build_and_push_main.arch += ["amd64", "arm64"]' <<< "$matrix")"

matrix="$(jq '.push_main_multiarch_manifests.name += ["RHACS_BRANDING", "STACKROX_BRANDING"]' <<< "$matrix")"

matrix="$(jq '.build_and_push_operator.name += ["RHACS_BRANDING", "STACKROX_BRANDING"]' <<< "$matrix")"

matrix="$(jq '.build_and_push_operator.arch += ["amd64", "arm64"]' <<< "$matrix")"

matrix="$(jq '.push_operator_multiarch_manifests.name += ["RHACS_BRANDING", "STACKROX_BRANDING"]' <<< "$matrix")"

matrix="$(jq '.push_operator_multiarch_manifests.archs = [.build_and_push_operator.arch | join(",")]' <<< "$matrix")"

matrix="$(jq '.build_and_push_scanner.name += ["default"]' <<< "$matrix")"

matrix="$(jq '.build_and_push_scanner.goos += ["linux"]' <<< "$matrix")"

matrix="$(jq '.build_and_push_scanner.arch += ["amd64", "arm64"]' <<< "$matrix")"

matrix="$(jq '.build_and_push_scanner.registry += ["quay.io/stackrox-io", "quay.io/rhacs-eng"]' <<< "$matrix")"

matrix="$(jq '.push_scanner_manifests.name += ["default"]' <<< "$matrix")"

matrix="$(jq '.push_scanner_manifests.registry += ["quay.io/stackrox-io", "quay.io/rhacs-eng"]' <<< "$matrix")"

if ! is_in_PR_context || pr_has_label ci-build-all-arch; then

matrix="$(jq '.pre_build_go_binaries.arch += ["ppc64le", "s390x"]' <<< "$matrix")"

matrix="$(jq '.build_and_push_main.arch += ["ppc64le", "s390x"]' <<< "$matrix")"

matrix="$(jq '.build_and_push_operator.arch += ["ppc64le", "s390x"]' <<< "$matrix")"

matrix="$(jq '.build_and_push_scanner.arch += ["ppc64le", "s390x"]' <<< "$matrix")"

fi;

# Conditionally add a prerelease build (binaries built with GOTAGS=release)

if ! is_tagged; then

if ! is_in_PR_context || pr_has_label ci-build-prerelease; then

matrix="$(jq '.pre_build_go_binaries.name += ["prerelease"]' <<< "$matrix")"

matrix="$(jq '.build_and_push_main.name += ["prerelease"]' <<< "$matrix")"

matrix="$(jq '.push_main_multiarch_manifests.name += ["prerelease"]' <<< "$matrix")"

matrix="$(jq '.build_and_push_scanner.name += ["prerelease"]' <<< "$matrix")"

matrix="$(jq '.push_scanner_manifests.name += ["prerelease"]' <<< "$matrix")"

fi

fi

# Conditionally add a -race debug build (binaries built with -race)

if ! is_in_PR_context || pr_has_label ci-build-race-condition-debug; then

matrix="$(jq '.pre_build_go_binaries.name += ["race-condition-debug"]' <<< "$matrix")"

matrix="$(jq '.build_and_push_main.name += ["race-condition-debug"]' <<< "$matrix")"

matrix="$(jq '.push_main_multiarch_manifests.name += ["race-condition-debug"]' <<< "$matrix")"

matrix="$(jq '.build_and_push_scanner.name += ["race-condition-debug"]' <<< "$matrix")"

matrix="$(jq '.push_scanner_manifests.name += ["race-condition-debug"]' <<< "$matrix")"

# Exclude "arm64", "ppc64le", "s390x"

matrix="$(jq '.pre_build_go_binaries.exclude = [{ "name": "race-condition-debug", "arch": "arm64" }]' <<< "$matrix")"

matrix="$(jq '.pre_build_go_binaries.exclude += [{ "name": "race-condition-debug", "arch": "ppc64le" }]' <<< "$matrix")"

matrix="$(jq '.pre_build_go_binaries.exclude += [{ "name": "race-condition-debug", "arch": "s390x" }]' <<< "$matrix")"

matrix="$(jq '.build_and_push_main.exclude = [{ "name": "race-condition-debug", "arch": "arm64" }]' <<< "$matrix")"

matrix="$(jq '.build_and_push_main.exclude += [{ "name": "race-condition-debug", "arch": "ppc64le" }]' <<< "$matrix")"

matrix="$(jq '.build_and_push_main.exclude += [{ "name": "race-condition-debug", "arch": "s390x" }]' <<< "$matrix")"

matrix="$(jq '.build_and_push_scanner.exclude = [{ "name": "race-condition-debug", "arch": "arm64" }]' <<< "$matrix")"

matrix="$(jq '.build_and_push_scanner.exclude += [{ "name": "race-condition-debug", "arch": "ppc64le" }]' <<< "$matrix")"

matrix="$(jq '.build_and_push_scanner.exclude += [{ "name": "race-condition-debug", "arch": "s390x" }]' <<< "$matrix")"

fi

echo "Job matrix after conditionals:"

jq <<< "$matrix"

condensed="$(jq -c <<< "$matrix")"

echo "matrix=$condensed" >> "$GITHUB_OUTPUT"

pre-build-ui:

strategy:

fail-fast: false

matrix:

branding: [ RHACS_BRANDING, STACKROX_BRANDING ]

env:

ROX_PRODUCT_BRANDING: ${{ matrix.branding }}

# For consistency with `image/rhel/konflux.Dockerfile`, see comment there.

UI_PKG_INSTALL_EXTRA_ARGS: --ignore-scripts

runs-on: ubuntu-latest

steps:

- name: Checkout

uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0

with:

fetch-depth: 0

ref: ${{ inputs.commit || github.event.pull_request.head.sha }}

- uses: ./.github/actions/job-preamble

with:

gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }}

- name: Set up Node.js

uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # ratchet:actions/setup-node@v6

with:

node-version-file: ui/package.json

- name: Cache UI dependencies

id: cache-ui

uses: ./.github/actions/cache-ui-dependencies

- name: Fetch UI deps

if: steps.cache-ui.outputs.cache-hit != 'true'

run: make -C ui deps

- name: Skip UI deps on cache hit

if: steps.cache-ui.outputs.cache-hit == 'true'

run: touch ui/deps

- name: Build UI

run: make -C ui build

- uses: ./.github/actions/upload-artifact-with-retry

with:

name: ui-${{env.ROX_PRODUCT_BRANDING}}-build

path: |

ui/build

ui/apps/platform/package-lock.json

pre-build-cli:

needs: define-job-matrix

runs-on: ubuntu-latest

env:

BUILD_TAG: ${{ needs.define-job-matrix.outputs.build-tag }}

SHORTCOMMIT: ${{ needs.define-job-matrix.outputs.short-commit }}

GOTAGS: ${{ needs.define-job-matrix.outputs.gotags }}

steps:

- name: Checkout

uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0

with:

ref: ${{ inputs.commit || github.event.pull_request.head.sha }}

- uses: ./.github/actions/job-preamble

with:

gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }}

- name: Create CLI stub files

if: |

!(needs.define-job-matrix.outputs.gotags == 'release'

|| github.ref_name == 'master'

|| github.event_name == 'workflow_call'

|| contains(github.event.pull_request.labels.*.name, 'ci-build-cli'))

run: |

cat > stub.txt << 'EOF'

This is a placeholder file. CLI binaries were not built for this PR build.

To build CLI binaries in PR builds:

- Add the "ci-build-cli" label to your pull request

- Re-push to trigger a new build

To download the latest roxctl binary:

- Visit https://mirror.openshift.com/pub/rhacs/assets/latest/bin/

EOF

mkdir -p bin/{linux_{amd64,arm64,ppc64le,s390x},darwin_{amd64,arm64},windows_amd64}

for arch in linux_amd64 linux_arm64 linux_ppc64le linux_s390x darwin_amd64 darwin_arm64; do

cp stub.txt bin/${arch}/roxctl

cp stub.txt bin/${arch}/roxagent

done

cp stub.txt bin/windows_amd64/roxctl.exe

- name: PR labels

uses: joerick/pr-labels-action@0543b277721e852d821c6738d449f2f4dea03d5f # ratchet:joerick/pr-labels-action@v1.0.9

- name: Cache Go dependencies

if: |

needs.define-job-matrix.outputs.gotags == 'release'

|| github.ref_name == 'master'

|| github.event_name == 'workflow_call'

|| contains(github.event.pull_request.labels.*.name, 'ci-build-cli')

uses: ./.github/actions/cache-go-dependencies

- name: Build CLI

if: |

needs.define-job-matrix.outputs.gotags == 'release'

|| github.ref_name == 'master'

|| github.event_name == 'workflow_call'

|| contains(github.event.pull_request.labels.*.name, 'ci-build-cli')

run: make cli

- name: Bundle build to preserve permissions

run: tar -cvf cli-build.tar bin

- uses: ./.github/actions/upload-artifact-with-retry

with:

name: cli-build

path: cli-build.tar

compression-level: 1

pre-build-go-binaries:

strategy:

# Supports three go binary builds:

# default - built with environment defaults (see env.mk)

# prerelease - built with GOTAGS=release

# race-condition-debug - built with -race

matrix: ${{ fromJson(needs.define-job-matrix.outputs.matrix).pre_build_go_binaries }}

needs: define-job-matrix

runs-on: ubuntu-latest

env:

BUILD_TAG: ${{ needs.define-job-matrix.outputs.build-tag }}

SHORTCOMMIT: ${{ needs.define-job-matrix.outputs.short-commit }}

GOTAGS: ${{ needs.define-job-matrix.outputs.gotags }}

steps:

- name: Checkout

uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0

with:

ref: ${{ inputs.commit || github.event.pull_request.head.sha }}

- uses: ./.github/actions/job-preamble

with:

gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }}

- name: Cache Go dependencies

env:

GOARCH: ${{ matrix.arch }}

uses: ./.github/actions/cache-go-dependencies

with:

# Only race needs a separate cache (-race/CGO_ENABLED=1 produces 39% unique entries).

# Default and prerelease share 93% of entries and should use the same cache.

key-suffix: ${{ (matrix.name == 'race-condition-debug' && 'race') || '' }}

- name: PR labels

uses: joerick/pr-labels-action@0543b277721e852d821c6738d449f2f4dea03d5f # ratchet:joerick/pr-labels-action@v1.0.9

- name: Setup build env for debugging support

run: |

if [[ "${GITHUB_HEAD_REF:-}" =~ -debug ]]; then

echo "DEBUG_BUILD=yes" >> "${GITHUB_ENV}"

fi

- name: Setup Go build environment for release

if: |

contains(github.event.pull_request.labels.*.name, 'ci-release-build')

||

matrix.name == 'prerelease'

run: echo "GOTAGS=release" >> "$GITHUB_ENV"

- name: Setup Go build environment for -race

if: |

matrix.arch == 'amd64'

&&

(

contains(github.event.pull_request.labels.*.name, 'ci-race-tests')

||

matrix.name == 'race-condition-debug'

)

run: echo "RACE=true" >> "$GITHUB_ENV"

- name: Install musl-tools for race builds

if: |

matrix.arch == 'amd64'

&&

(

contains(github.event.pull_request.labels.*.name, 'ci-race-tests')

||

matrix.name == 'race-condition-debug'

)

run: |

sudo apt-get update -qq && sudo apt-get install -y -qq musl-tools musl-dev linux-libc-dev

# musl-gcc searches /usr/include/x86_64-linux-musl by default

sudo ln -sf /usr/include/linux /usr/include/x86_64-linux-musl/linux

sudo ln -sf /usr/include/asm-generic /usr/include/x86_64-linux-musl/asm-generic

sudo ln -sf /usr/include/asm /usr/include/x86_64-linux-musl/asm

- name: Build Go Binaries

run: GOOS=linux GOARCH=${{ matrix.arch }} CGO_ENABLED=0 make build-prep main-build-nodeps roxctl_linux-${{ matrix.arch }}

- name: Bundle the build to preserve permissions

run: tar -cvf go-binaries-build.tar bin/linux_${{ matrix.arch }}

- uses: ./.github/actions/upload-artifact-with-retry

with:

name: go-binaries-build-${{ matrix.arch }}-${{ matrix.name }}

path: go-binaries-build.tar

compression-level: 1

pre-build-docs:

runs-on: ubuntu-latest

steps:

- name: Checkout

uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0

with:

fetch-depth: 0

ref: ${{ inputs.commit || github.event.pull_request.head.sha }}

- uses: ./.github/actions/job-preamble

with:

gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }}

- name: Cache Go dependencies

uses: ./.github/actions/cache-go-dependencies

- name: Download scanner module for proto generation

run: go mod download github.com/stackrox/scanner

- name: Generate the swagger docs

run: |

make swagger-docs

# Workaround to handle https://github.com/actions/cache/issues/753

rm -rf .proto

- uses: ./.github/actions/upload-artifact-with-retry

with:

name: docs-build

path: |

image/rhel/docs

pre-build-oss-notice:

runs-on: ubuntu-latest

steps:

- name: Checkout

uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0

with:

fetch-depth: 0

ref: ${{ inputs.commit || github.event.pull_request.head.sha }}

- uses: ./.github/actions/job-preamble

with:

gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }}

- name: Set up Node.js

uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # ratchet:actions/setup-node@v6

with:

node-version-file: ui/package.json

- name: Cache Go dependencies

uses: ./.github/actions/cache-go-dependencies

- name: Cache UI dependencies

id: cache-ui

uses: ./.github/actions/cache-ui-dependencies

- name: Fetch UI deps

if: steps.cache-ui.outputs.cache-hit != 'true'

run: make -C ui deps

- name: Skip UI deps on cache hit

if: steps.cache-ui.outputs.cache-hit == 'true'

run: touch ui/deps

- name: Generate OSS notice

run: make ossls-notice

- uses: ./.github/actions/upload-artifact-with-retry

with:

name: oss-notice

path: image/rhel/THIRD_PARTY_NOTICES

build-and-push-db:

runs-on: ubuntu-latest

needs:

- define-job-matrix

if: ${{ !cancelled() }}

env:

BUILD_TAG: ${{ needs.define-job-matrix.outputs.build-tag }}

steps:

- name: Checkout

uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0

with:

ref: ${{ inputs.commit || github.event.pull_request.head.sha }}

- uses: ./.github/actions/job-preamble

with:

gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }}

- name: Login to docker.io to mitigate rate limiting on downloading images

uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # ratchet:docker/login-action@v4

continue-on-error: true

if: |

github.event_name == 'push' || !github.event.pull_request.head.repo.fork

with:

username: ${{ secrets.DOCKERHUB_CI_ACCOUNT_USERNAME }}

password: ${{ secrets.DOCKERHUB_CI_ACCOUNT_PASSWORD }}

- name: Set up QEMU

uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # ratchet:docker/setup-qemu-action@v4

- name: Set up Docker Buildx

uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # ratchet:docker/setup-buildx-action@v4

- name: Determine platforms

id: platforms

run: |

PLATFORMS="linux/amd64,linux/arm64"

if [[ "${{ github.event_name }}" != "pull_request" ]] || \

[[ "${{ contains(github.event.pull_request.labels.*.name, 'ci-build-all-arch') }}" == "true" ]]; then

PLATFORMS="linux/amd64,linux/arm64,linux/ppc64le,linux/s390x"

fi

echo "platforms=${PLATFORMS}" >> "$GITHUB_OUTPUT"

- name: Login to quay.io/stackrox-io

if: |

github.event_name == 'push' || !github.event.pull_request.head.repo.fork

uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # ratchet:docker/login-action@v4

with:

registry: quay.io

username: ${{ secrets.QUAY_STACKROX_IO_RW_USERNAME }}

password: ${{ secrets.QUAY_STACKROX_IO_RW_PASSWORD }}

# scanner/image/db/Dockerfile does COPY init-bundles/db-init.dump.zst.

# This file is not in git - the Makefile creates it as empty by default

# (or populated if SCANNER_DB_INIT_BUNDLE_ENABLED=force, which is not used).

# Since we bypass make and build directly with buildx, we create the empty

# file here to match the default make behavior. The init script ignores it.

- name: Create empty init bundle for scanner-v4-db

run: |

mkdir -p scanner/image/db/init-bundles

touch scanner/image/db/init-bundles/db-init.dump.zst

- name: Build and push DB images in parallel with bake

if: |

github.event_name == 'push' || !github.event.pull_request.head.repo.fork

uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # ratchet:docker/bake-action@v7.3.0

with:

source: .

files: .github/docker/images.hcl

targets: databases

push: true

env:

TAG: ${{ env.BUILD_TAG }}

PLATFORMS: ${{ steps.platforms.outputs.platforms }}

REGISTRY: quay.io/stackrox-io

QUAY_TAG_EXPIRATION: ${{ needs.define-job-matrix.outputs.quay-tag-expiration }}

# We can't push to both quay.io/stackrox-io and quay.io/rhacs-eng in a single

# build because they require different credentials (different organizations).

# Instead, we build once and push to stackrox-io, then use skopeo to copy the

# multi-arch manifest list to rhacs-eng. This is more efficient than building

# twice and matches the pattern used for collector retag.

- name: Login to quay.io/rhacs-eng

if: |

github.event_name == 'push' || !github.event.pull_request.head.repo.fork

uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # ratchet:docker/login-action@v4

with:

registry: quay.io

username: ${{ secrets.QUAY_RHACS_ENG_RW_USERNAME }}

password: ${{ secrets.QUAY_RHACS_ENG_RW_PASSWORD }}

- name: Copy central-db to rhacs-eng registry

if: |

github.event_name == 'push' || !github.event.pull_request.head.repo.fork

run: |

skopeo copy --retry-times 5 --all \

"docker://quay.io/stackrox-io/central-db:${{ env.BUILD_TAG }}" \

"docker://quay.io/rhacs-eng/central-db:${{ env.BUILD_TAG }}"

- name: Copy scanner-v4-db to rhacs-eng registry

if: |

github.event_name == 'push' || !github.event.pull_request.head.repo.fork

run: |

skopeo copy --retry-times 5 --all \

"docker://quay.io/stackrox-io/scanner-v4-db:${{ env.BUILD_TAG }}" \

"docker://quay.io/rhacs-eng/scanner-v4-db:${{ env.BUILD_TAG }}"

build-operator-bundle:

runs-on: ubuntu-latest

env:

QUAY_ORG: rhacs-eng

QUAY_RHACS_ENG_RW_PASSWORD: ${{ secrets.QUAY_RHACS_ENG_RW_PASSWORD }}

QUAY_RHACS_ENG_RW_USERNAME: ${{ secrets.QUAY_RHACS_ENG_RW_USERNAME }}

ROX_OPERATOR_SKIP_PROTO_GENERATED_SRCS: true

ROX_PRODUCT_BRANDING: RHACS_BRANDING

steps:

- name: Checkout

uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0

with:

fetch-depth: 0

ref: ${{ inputs.commit || github.event.pull_request.head.sha }}

- uses: ./.github/actions/job-preamble

with:

gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }}

- name: Cache Go dependencies

uses: ./.github/actions/cache-go-dependencies

- uses: ./.github/actions/handle-tagged-build

- name: Build Operator Bundle

run: make -C operator/ bundle bundle-build

- name: Push Operator Bundle and Index

# Skip for external contributions.

if: |

github.event_name == 'push' || !github.event.pull_request.head.repo.fork

run: |

./scripts/ci/lib.sh registry_rw_login "quay.io/${QUAY_ORG}"

make -C operator/ docker-push-bundle | cat

make -C operator/ index-build

make -C operator/ docker-push-index | cat

build-and-push-main:

# Use native arm64 runner to avoid QEMU emulation overhead (~2x slower).

runs-on: ${{ (matrix.arch == 'arm64' && 'ubuntu-24.04-arm') || 'ubuntu-latest' }}

needs:

- define-job-matrix

- pre-build-cli

- pre-build-docs

- pre-build-go-binaries

- pre-build-oss-notice

- pre-build-ui

# This step will run even if required pre-* steps failed. By following this

# approach as much of the build matrix as possible is completed despite

# transient issues e.g. docker pull timeouts. In this way some e2e jobs that

# require some part of the build matrix can still proceed.

if: ${{ !cancelled() }}

strategy:

# Supports four image builds (see Setup build env):

# STACKROX_BRANDING

# RHACS_BRANDING

# prerelease

# race-condition-debug

fail-fast: false

matrix: ${{ fromJson(needs.define-job-matrix.outputs.matrix).build_and_push_main }}

env:

GO_BINARIES_BUILD_ARTIFACT: ""

ROX_PRODUCT_BRANDING: ""

BUILD_TAG: ${{ needs.define-job-matrix.outputs.build-tag }}

SHORTCOMMIT: ${{ needs.define-job-matrix.outputs.short-commit }}

GOTAGS: ${{ needs.define-job-matrix.outputs.gotags }}

steps:

- name: Setup build env

run: |

case "${{ matrix.name }}" in

STACKROX_BRANDING)

go_binaries="default"

brand="STACKROX_BRANDING"

;;

RHACS_BRANDING)

go_binaries="default"

brand="RHACS_BRANDING"

;;

race-condition-debug)

go_binaries="race-condition-debug"

brand="RHACS_BRANDING"

;;

prerelease)

go_binaries="prerelease"

brand="RHACS_BRANDING"

;;

*)

echo "Unsupported build: ${{ matrix.name }}"

exit 1

esac

{

echo "GO_BINARIES_BUILD_ARTIFACT=go-binaries-build-${{ matrix.arch }}-${go_binaries}"

echo "ROX_PRODUCT_BRANDING=${brand}"

} >> "$GITHUB_ENV"

if [[ "${GITHUB_HEAD_REF:-}" =~ -debug ]]; then

echo "DEBUG_BUILD=yes" >> "${GITHUB_ENV}"

fi

- name: Checkout

uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0

with:

ref: ${{ inputs.commit || github.event.pull_request.head.sha }}

- uses: ./.github/actions/job-preamble

with:

gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }}

- name: Login to docker.io to mitigate rate limiting on downloading images

uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # ratchet:docker/login-action@v4

continue-on-error: true

# Skip for external contributions.

if: |

matrix.arch != 'amd64' && matrix.arch != 'arm64' &&

(github.event_name == 'push' || !github.event.pull_request.head.repo.fork)

with:

username: ${{ secrets.DOCKERHUB_CI_ACCOUNT_USERNAME }}

password: ${{ secrets.DOCKERHUB_CI_ACCOUNT_PASSWORD }}

- name: Set up QEMU

if: matrix.arch != 'amd64' && matrix.arch != 'arm64'

uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # ratchet:docker/setup-qemu-action@v4

- name: Set up Docker Buildx

uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # ratchet:docker/setup-buildx-action@v4

- name: Checkout submodules

run: |

git submodule update --init

- uses: ./.github/actions/download-artifact-with-retry

with:

name: ui-${{ env.ROX_PRODUCT_BRANDING }}-build

path: ui

- uses: ./.github/actions/download-artifact-with-retry

with:

name: cli-build

- name: Unpack cli build

run: |

tar xvf cli-build.tar

- uses: ./.github/actions/download-artifact-with-retry

with:

name: ${{ env.GO_BINARIES_BUILD_ARTIFACT }}

- name: Unpack Go binaries build

run: |

tar xvf go-binaries-build.tar

- uses: ./.github/actions/download-artifact-with-retry

with:

name: docs-build

path: image/rhel/docs

- uses: ./.github/actions/download-artifact-with-retry

with:

name: oss-notice

path: image/rhel/THIRD_PARTY_NOTICES

- name: Set build tag for prerelease images

if: matrix.name == 'prerelease'

run: echo "BUILD_TAG=$(make --quiet --no-print-directory tag)-prerelease" >> "$GITHUB_ENV"

- name: Set build tag for race condition images

if: matrix.name == 'race-condition-debug'

run: echo "BUILD_TAG=$(make --quiet --no-print-directory tag)-rcd" >> "$GITHUB_ENV"

- name: Build main images

run: |

GOOS=linux GOARCH=${{ matrix.arch }} scripts/lib.sh retry 6 true make docker-build-main-image

- name: Check debugger presence in the main image

if: github.event_name != 'pull_request'

run: make check-debugger

- name: Prepare roxctl build context

run: |

cp -r image/rhel/THIRD_PARTY_NOTICES image/roxctl/THIRD_PARTY_NOTICES

- name: Build roxctl image

run: |

GOOS=linux GOARCH=${{ matrix.arch }} scripts/lib.sh retry 6 true make docker-build-roxctl-image

# needed for docs ensure_image.sh initial pull with RHACS_BRANDING

- name: Docker login

# Skip for external contributions.

if: |

github.event_name == 'push' || !github.event.pull_request.head.repo.fork

env:

QUAY_RHACS_ENG_RO_USERNAME: ${{ secrets.QUAY_RHACS_ENG_RO_USERNAME }}

QUAY_RHACS_ENG_RO_PASSWORD: ${{ secrets.QUAY_RHACS_ENG_RO_PASSWORD }}

run: |

./scripts/ci/lib.sh registry_ro_login "quay.io/rhacs-eng"

- name: Push images

# Skip for external contributions.

if: |

github.event_name == 'push' || !github.event.pull_request.head.repo.fork

env:

QUAY_RHACS_ENG_RW_USERNAME: ${{ secrets.QUAY_RHACS_ENG_RW_USERNAME }}

QUAY_RHACS_ENG_RW_PASSWORD: ${{ secrets.QUAY_RHACS_ENG_RW_PASSWORD }}

QUAY_STACKROX_IO_RW_USERNAME: ${{ secrets.QUAY_STACKROX_IO_RW_USERNAME }}

QUAY_STACKROX_IO_RW_PASSWORD: ${{ secrets.QUAY_STACKROX_IO_RW_PASSWORD }}

run: |

source ./scripts/ci/lib.sh

echo "Will determine context from: ${{ github.event_name }} & ${{ github.ref_name }}"

push_context=""

if [[ "${{ github.event_name }}" == "push" && "${{ github.ref_name }}" == "master" ]]; then

push_context="merge-to-master"

fi

push_main_image_set "$push_context" "${{ env.ROX_PRODUCT_BRANDING }}" "${{ matrix.arch }}"

push-matching-collector-scanner:

runs-on: ubuntu-latest

needs:

- define-job-matrix

if: ${{ !cancelled() }}

strategy:

fail-fast: false

matrix:

name: [RHACS_BRANDING, STACKROX_BRANDING]

env:

ROX_PRODUCT_BRANDING: ${{ matrix.name }}

BUILD_TAG: ${{ needs.define-job-matrix.outputs.build-tag }}

steps:

- name: Checkout

uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0

with:

ref: ${{ inputs.commit || github.event.pull_request.head.sha }}

- uses: ./.github/actions/job-preamble

with:

gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }}

- name: Push matching collector and scanner images

if: github.event_name == 'push' || !github.event.pull_request.head.repo.fork

env:

QUAY_RHACS_ENG_RW_USERNAME: ${{ secrets.QUAY_RHACS_ENG_RW_USERNAME }}

QUAY_RHACS_ENG_RW_PASSWORD: ${{ secrets.QUAY_RHACS_ENG_RW_PASSWORD }}

QUAY_STACKROX_IO_RW_USERNAME: ${{ secrets.QUAY_STACKROX_IO_RW_USERNAME }}

QUAY_STACKROX_IO_RW_PASSWORD: ${{ secrets.QUAY_STACKROX_IO_RW_PASSWORD }}

run: |

source ./scripts/ci/lib.sh

push_matching_collector_scanner_images "${{ env.ROX_PRODUCT_BRANDING }}"

push-main-manifests:

runs-on: ubuntu-latest

needs:

- define-job-matrix

- build-and-push-main

# This step will run even if some of the build-and-push-matrix steps failed.

# By following this approach as much of the build matrix as possible is

# completed despite transient issues e.g. docker pull timeouts. In this way

# some e2e jobs that require some part of the build matrix can still

# proceed.

if: ${{ !cancelled() }}

permissions:

pull-requests: write

strategy:

# Supports four image builds (see Setup build env):

# STACKROX_BRANDING

# RHACS_BRANDING

# prerelease

# race-condition-debug

fail-fast: false

matrix: ${{ fromJson(needs.define-job-matrix.outputs.matrix).push_main_multiarch_manifests }}

env:

ROX_PRODUCT_BRANDING: ""

BUILD_TAG: ${{ needs.define-job-matrix.outputs.build-tag }}

SHORTCOMMIT: ${{ needs.define-job-matrix.outputs.short-commit }}

GOTAGS: ${{ needs.define-job-matrix.outputs.gotags }}

steps:

- name: Setup build env

run: |

case "${{ matrix.name }}" in

STACKROX_BRANDING)

brand="STACKROX_BRANDING"

;;

RHACS_BRANDING)

brand="RHACS_BRANDING"

;;

race-condition-debug)

brand="RHACS_BRANDING"

;;

prerelease)

brand="RHACS_BRANDING"

;;

*)

echo "Unsupported build: ${{ matrix.name }}"

exit 1

esac

{

echo "ROX_PRODUCT_BRANDING=${brand}"

} >> "$GITHUB_ENV"

- name: Checkout

uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0

with:

ref: ${{ inputs.commit || github.event.pull_request.head.sha }}

- uses: ./.github/actions/job-preamble

with:

gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }}

- name: Set up Docker Buildx

uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # ratchet:docker/setup-buildx-action@v4

- name: Checkout submodules

run: |

git submodule update --init

- name: Set build tag for prerelease images

if: matrix.name == 'prerelease'

run: echo "BUILD_TAG=$(make --quiet --no-print-directory tag)-prerelease" >> "$GITHUB_ENV"

- name: Set build tag for race condition images

if: matrix.name == 'race-condition-debug'

run: echo "BUILD_TAG=$(make --quiet --no-print-directory tag)-rcd" >> "$GITHUB_ENV"

- name: Build and push manifest lists

# Skip for external contributions.

if: |

github.event_name == 'push' || !github.event.pull_request.head.repo.fork

env:

QUAY_RHACS_ENG_RW_USERNAME: ${{ secrets.QUAY_RHACS_ENG_RW_USERNAME }}

QUAY_RHACS_ENG_RW_PASSWORD: ${{ secrets.QUAY_RHACS_ENG_RW_PASSWORD }}

QUAY_STACKROX_IO_RW_USERNAME: ${{ secrets.QUAY_STACKROX_IO_RW_USERNAME }}

QUAY_STACKROX_IO_RW_PASSWORD: ${{ secrets.QUAY_STACKROX_IO_RW_PASSWORD }}

run: |

source ./scripts/ci/lib.sh

echo "Will determine context from: ${{ github.event_name }} & ${{ github.ref_name }}"

push_context=""

if [[ "${{ github.event_name }}" == "push" && "${{ github.ref_name }}" == "master" ]]; then

push_context="merge-to-master"

fi

architectures="amd64,arm64"

if ! is_in_PR_context || pr_has_label ci-build-all-arch; then

architectures="amd64,arm64,ppc64le,s390x"

fi

if [[ "${{ matrix.name }}" == "race-condition-debug" ]]; then

architectures="amd64"

fi

push_image_manifest_lists "$push_context" "${{ env.ROX_PRODUCT_BRANDING }}" "$architectures"

- name: Prepare build comment

# Skip for external contributions.

if: |

github.event_name == 'push' || !github.event.pull_request.head.repo.fork

run: |

cat > build-comment.md <<EOF

## 🚀 Build Images Ready

Images are ready for commit ${{ needs.define-job-matrix.outputs.short-commit }}. To use with deploy scripts:

\`\`\`bash

export MAIN_IMAGE_TAG=${{ needs.define-job-matrix.outputs.build-tag }}

\`\`\`

EOF

- name: Comment on the PR

# Skip for external contributions.

if: |

github.event_name == 'push' || !github.event.pull_request.head.repo.fork

uses: mshick/add-pr-comment@ec328af66588ab8f77cdeb2c264f14aba45bbf59 # ratchet:mshick/add-pr-comment@v3

with:

message-id: build-images-ready

message-path: build-comment.md

build-and-push-operator:

runs-on: ${{ (matrix.arch == 'arm64' && 'ubuntu-24.04-arm') || 'ubuntu-latest' }}

needs:

- define-job-matrix

- pre-build-go-binaries

- pre-build-oss-notice

strategy:

fail-fast: false

matrix: ${{ fromJson(needs.define-job-matrix.outputs.matrix).build_and_push_operator }}

env:

ROX_PRODUCT_BRANDING: ${{ matrix.name }}

# Proto sources freshness is checked in another workflow.

ROX_OPERATOR_SKIP_PROTO_GENERATED_SRCS: true

BUILD_TAG: ${{ needs.define-job-matrix.outputs.build-tag }}

SHORTCOMMIT: ${{ needs.define-job-matrix.outputs.short-commit }}

GOTAGS: ${{ needs.define-job-matrix.outputs.gotags }}

steps:

- name: Checkout

uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0

with:

ref: ${{ inputs.commit || github.event.pull_request.head.sha }}

- uses: ./.github/actions/job-preamble

with:

free-disk-space: 40

gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }}

- name: Set up Docker Buildx

uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # ratchet:docker/setup-buildx-action@v4

- name: Download prebuilt operator binaries

uses: ./.github/actions/download-artifact-with-retry

with:

name: go-binaries-build-${{ matrix.arch }}-default

- name: Extract prebuilt binaries

run: tar xf go-binaries-build.tar

- uses: ./.github/actions/download-artifact-with-retry

with:

name: oss-notice

path: THIRD_PARTY_NOTICES

- name: PR labels

uses: joerick/pr-labels-action@0543b277721e852d821c6738d449f2f4dea03d5f # ratchet:joerick/pr-labels-action@v1.0.9

- name: Setup Go release build environment

if: contains(github.event.pull_request.labels.*.name, 'ci-release-build')

run: echo "GOTAGS=release" >> "$GITHUB_ENV"

- name: Setup Go RHACS build environment

if: matrix.name == 'RHACS_BRANDING'

run: echo "QUAY_ORG=rhacs-eng" >> "$GITHUB_ENV"

- name: Setup Go StackRox build environment

if: matrix.name == 'STACKROX_BRANDING'

run: echo "QUAY_ORG=stackrox-io" >> "$GITHUB_ENV"

- name: Docker login

# Skip for external contributions.

if: |

github.event_name == 'push' || !github.event.pull_request.head.repo.fork

env:

QUAY_RHACS_ENG_RW_USERNAME: ${{ secrets.QUAY_RHACS_ENG_RW_USERNAME }}

QUAY_RHACS_ENG_RW_PASSWORD: ${{ secrets.QUAY_RHACS_ENG_RW_PASSWORD }}

QUAY_STACKROX_IO_RW_USERNAME: ${{ secrets.QUAY_STACKROX_IO_RW_USERNAME }}

QUAY_STACKROX_IO_RW_PASSWORD: ${{ secrets.QUAY_STACKROX_IO_RW_PASSWORD }}

run: |

./scripts/ci/lib.sh registry_rw_login "quay.io/${QUAY_ORG}"

- name: Build Operator image

run: |

GOARCH=${{ matrix.arch }} scripts/lib.sh retry 6 true make -C operator/ docker-build-prebuilt

- name: Login to docker.io to mitigate rate limiting on downloading images

uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # ratchet:docker/login-action@v4

continue-on-error: true

# Skip for external contributions.

if: |

matrix.arch != 'amd64' && matrix.arch != 'arm64' &&

(github.event_name == 'push' || !github.event.pull_request.head.repo.fork)

with:

username: ${{ secrets.DOCKERHUB_CI_ACCOUNT_USERNAME }}

password: ${{ secrets.DOCKERHUB_CI_ACCOUNT_PASSWORD }}

- name: Set up QEMU

if: matrix.arch != 'amd64' && matrix.arch != 'arm64'

uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # ratchet:docker/setup-qemu-action@v4