cd-build-unbound.yaml

name: CD Build Distroless Unbound Docker Image
   
on:   
  workflow_run:
    workflows: [CD Check NLnet Labs Unbound Release]
    types:
      - completed
 
jobs:
  buildvars:
    if: ${{ github.event.workflow_run.conclusion == 'success' }}
    runs-on: ubuntu-latest
    outputs:
      IMAGE_BUILD_DATE: ${{ steps.IMPORT_BUILDVARS.outputs.IMAGE_BUILD_DATE }}
      UNBOUND_DOCKER_IMAGE_VERSION: ${{ steps.IMPORT_BUILDVARS.outputs.UNBOUND_DOCKER_IMAGE_VERSION }}
      UNBOUND_VERSION: ${{ steps.IMPORT_BUILDVARS.outputs.UNBOUND_VERSION }}
      UNBOUND_SHA256: ${{ steps.IMPORT_BUILDVARS.outputs.UNBOUND_SHA256 }}
      OPENSSL_BUILDENV_VERSION: ${{ steps.GET_OPENSSL_BUILDENV_VERSION.outputs.OPENSSL_BUILDENV_VERSION }}
      
    steps:             
      - name: Checkout source
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Import build variables from buildvars file
        id: IMPORT_BUILDVARS
        run: |
          cat buildvars | grep UNBOUND_DOCKER_IMAGE_VERSION >> $GITHUB_OUTPUT
          cat buildvars | grep IMAGE_BUILD_DATE >> $GITHUB_OUTPUT
          cat buildvars | grep UNBOUND_VERSION >> $GITHUB_OUTPUT
          cat buildvars | grep UNBOUND_SHA256 >> $GITHUB_OUTPUT
          
      - name: Get OpenSSL buildenv version
        id: GET_OPENSSL_BUILDENV_VERSION
        run: | 
          echo OPENSSL_BUILDENV_VERSION="$(curl -s https://api.github.com/repos/madnuttah/openssl-buildenv/releases | jq '.[0] | .name' -r)" >> $GITHUB_OUTPUT
      
  build: 
    runs-on: ubuntu-latest    
    needs: buildvars
    steps:
      - name: Checkout source
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3
      
      - name: Set up Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@v3
     
      - name: Login to Dockerhub
        if: github.event_name != 'pull_request'
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
              
      - name: Build and push
        uses: docker/build-push-action@v6
        env:
          DOCKERHUB_SLUG: "madnuttah/unbound"
        with:
          platforms: linux/386,linux/arm/v6,linux/arm/v7,linux/arm64,linux/amd64
          builder: ${{ steps.buildx.outputs.name }}
          build-args: |
            UNBOUND_SHA256=${{ needs.buildvars.outputs.UNBOUND_SHA256 }}  
            IMAGE_BUILD_DATE=${{ needs.buildvars.outputs.IMAGE_BUILD_DATE }}  
            UNBOUND_VERSION=${{ needs.buildvars.outputs.UNBOUND_VERSION }}  
            UNBOUND_DOCKER_IMAGE_VERSION=${{ needs.buildvars.outputs.UNBOUND_DOCKER_IMAGE_VERSION }}
            OPENSSL_BUILDENV_VERSION=${{ needs.buildvars.outputs.OPENSSL_BUILDENV_VERSION }}
          file: ./unbound/release.Dockerfile   
          push: ${{ github.event_name != 'pull_request' }}
          sbom: ${{ github.event_name != 'pull_request' }}
          provenance: ${{ github.event_name != 'pull_request' }}
          tags: |
            ${{ env.DOCKERHUB_SLUG }}:${{ needs.buildvars.outputs.UNBOUND_DOCKER_IMAGE_VERSION }}   
            ${{ env.DOCKERHUB_SLUG }}:latest