reuse.yaml

name: Create Publish and Sign Docker Image for FIPS Compliance
on:
  workflow_call:
    inputs:
      publish_command:
        required: true
        type: string
      digest_command:
        required: true
        type: string
      image_name:
        required: true
        type: string
      tag:
        required: true
        type: string
      main:
        type: string
    secrets:
      registry_username:
        required: true
      registry_password:
        required: true
jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      id-token: write
    steps:
    - name: Detect Runner Architecture
      run: |
        ARCH=$(uname -m)
        echo "Detected architecture: $ARCH"
        echo "ARCH=$ARCH" >> $GITHUB_ENV

    - name: Checkout release
      if: ${{ inputs.tag == 'release'}}
      uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579 # v2.4.0
      with:
        fetch-depth: 0

    - name: Set up Go
      uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
      with:
        go-version: ~1.23.5

    - name: Install Cosign
      uses: sigstore/cosign-installer@4959ce089c160fddf62f7b42464195ba1a56d382 # v3.6.0

    - name: Cache Go modules
      uses: actions/cache@v4
      with:
        path: ~/go/pkg/mod
        key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
        restore-keys: |
          ${{ runner.os }}-go-

    - name: Log into ghcr.io
      uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
      with:
        registry: ghcr.io
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    - name: Set up binfmt
      uses: docker/setup-buildx-action@v3.8.0

    - name: Install binfmt
      run: |
        docker run --rm --privileged tonistiigi/binfmt --install all
    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@6524bf65af31da8d45b59e8c27de4bd072b392f5 #v3.8.0
      id: buildx
      with:
        install: true

    - name: Run Trivy vulnerability scanner in repo mode
      if: ${{inputs.tag == 'release'}}
      uses: aquasecurity/trivy-action@40c4ca9e7421287d0c5576712fdff370978f9c3c
      with:
        scan-type: 'fs'
        ignore-unfixed: true
        format: 'sarif'
        output: 'trivy-results.sarif'
        severity: 'CRITICAL,HIGH'

    - name: Set Version
      if: ${{ inputs.tag == 'release'}}
      run: |
        echo "REPORTS_SERVER_VERSION=$(git describe --match "v[0-9]*" --tags $(git rev-list --tags --max-count=1))" >> $GITHUB_ENV
    - name: Generate SBOM JSON
      if: ${{inputs.tag == 'release'}}
      uses: CycloneDX/gh-gomod-generate-sbom@c18e41a4e3defe6dbf69b594e4d831a89db82ead # v1.0.0
      with:
        version: v1
        args: app -licenses -json -output ${{inputs.image_name}}-${{ env.REPORTS_SERVER_VERSION }}-bom.cdx.json -main ${{inputs.main}}

    - name: Upload SBOM JSON
      if: ${{inputs.tag == 'release'}}
      uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
      with:
        name: ${{inputs.image_name}}-bom-cdx
        path: ${{inputs.image_name}}-v*-bom.cdx.json

    - name: Check branch
      if: ${{inputs.tag == 'image' && steps.extract_branch.outputs.branch != 'main'}}
      id: check-branch
      run: |
        if [[ ${{ steps.extract_branch.outputs.branch }} =~ ^release-[0-9]+\.[0-9]$ ]]; then
            echo ::set-output name=match::true
        fi
    - name: Docker images publish
      if: ${{inputs.tag == 'image' && steps.extract_branch.outputs.branch == 'main'}}
      run: make ${{inputs.publish_command}} FIPS_ENABLED=1

    - name: get image digest
      if: ${{inputs.tag == 'image' && steps.extract_branch.outputs.branch == 'main'}}
      id: get-step-image
      run: |
        digest=$(make ${{inputs.digest_command}} FIPS_ENABLED=1) 
        echo "digest=${digest}" >> $GITHUB_ENV
    - name: Docker release-images publish
      if: ${{inputs.tag == 'release' }}
      run: make ${{inputs.publish_command}} FIPS_ENABLED=1

    - name: Clear Sigstore TUF Cache
      run: |
        rm -rf ~/.sigstore
    - name: Get release-image digest
      if: ${{ inputs.tag == 'release' }}
      id: get-step
      run: |
        digest=$(make ${{inputs.digest_command}} FIPS_ENABLED=1  2>/dev/null || true)
        if [[ -z "$digest" ]]; then
          echo "Error: Unable to generate digest. Ensure the repository exists and credentials are valid." >&2
          exit 1
        fi
        echo "digest=$digest" >> $GITHUB_ENV
        echo "Digest: $digest"
    - name: Debug Digest
      run: |
        echo "Digest: ${{ env.digest }}"
        if [[ -z "${{ env.digest }}" || "${{ env.digest }}" == "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" ]]; then
          echo "Error: Digest is empty or invalid." >&2
          exit 1
        fi
    - name: Sign release-image
      if: ${{ inputs.tag == 'release' || (inputs.tag == 'image' && steps.check-branch.outputs.match == 'true') }}
      env:
        COSIGN_EXPERIMENTAL: "true"
        COSIGN_REPOSITORY: "ghcr.io/${{ github.repository_owner }}/${{ github.repository }}/signatures"
        digest: ${{ env.digest }}
      run: |
        echo "Signing with digest: $digest"
        cosign sign --yes \
          -a "repo=${{ github.repository }}" \
          -a "workflow=${{ github.workflow }}" \
          -a "ref=${{ github.sha }}" \
          ghcr.io/${{ github.repository_owner }}/${{ inputs.image_name }}@sha256:$digest
    - name: Attach SBOM
      if: ${{inputs.tag == 'release'}}
      env:
        COSIGN_REPOSITORY: "ghcr.io/${{ github.repository_owner }}/${{ github.repository }}/sbom"
      run: cosign attach sbom --sbom ./${{inputs.image_name}}-v*-bom.cdx.json --type cyclonedx  ghcr.io/${{ github.repository_owner }}/${{inputs.image_name}}@sha256:${{ env.digest }}