rock-build.yaml

name: Build ROCK

on:
  workflow_dispatch: {}
  push:
    branches:
      - main
  schedule:
    - cron: "0 12 * * 0"

jobs:
  main:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout repository
      uses: actions/checkout@v3

    - name: Setup LXD
      uses: canonical/setup-lxd@v0.1.1
      with:
        channel: latest/stable

    - name: Install dependencies
      run: |
        sudo snap install yq
        sudo snap install --classic --channel edge rockcraft

    - name: Build ROCK
      id: build_rock
      run: |
        rockcraft pack --verbose
        digest=$(skopeo inspect oci-archive:$(realpath ./cos-alerter_*.rock) --format '{{.Digest}}')
        echo "digest=${digest#*:}" >> "$GITHUB_OUTPUT"

    - name: Add git tag
      uses: mathieudutour/github-tag-action@v6.1
      with:
        github_token: ${{ secrets.GITHUB_TOKEN }}
        custom_tag: "${{ steps.build_rock.outputs.digest }}"
        tag_prefix: ""

    - name: Upload ROCK to ghcr.io
      run: |
        VERSION=$(yq -r '.version' rockcraft.yaml)
        sudo skopeo --insecure-policy copy oci-archive:$(realpath ./cos-alerter_*.rock) docker://ghcr.io/canonical/cos-alerter:$VERSION --dest-creds "observability-noctua-bot:${{ secrets.OBSERVABILITY_NOCTUA_TOKEN }}"
        sudo skopeo --insecure-policy copy oci-archive:$(realpath ./cos-alerter_*.rock) docker://ghcr.io/canonical/cos-alerter:latest --dest-creds "observability-noctua-bot:${{ secrets.OBSERVABILITY_NOCTUA_TOKEN }}"
        MINOR_VERSION=${VERSION%.*}
        sudo skopeo --insecure-policy copy oci-archive:$(realpath ./cos-alerter_*.rock) docker://ghcr.io/canonical/cos-alerter:$MINOR_VERSION --dest-creds "observability-noctua-bot:${{ secrets.OBSERVABILITY_NOCTUA_TOKEN }}"

    - name: Install Syft
      run: |
        curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin

    - name: Create SBOM
      run: syft $(realpath ./cos-alerter_*.rock) -o spdx-json=cos-alerter.sbom.json

    - name: Upload SBOM
      uses: actions/upload-artifact@v3
      with:
        name: cos-alerter-sbom
        path: "cos-alerter.sbom.json"
    - name: Upload locally built ROCK artifact
      uses: actions/upload-artifact@v3
      with:
        name: cos-alerter-rock
        path: "cos-alerter_*.rock"