build-sign-commit-images.yaml

name: Build and Sign Blockchain Commit Images

on:
  push:
    branches-ignore:
      - 'release/[0-9]+.[0-9]+'
  workflow_dispatch:

jobs:
  build-container-geth-sha:
    runs-on: [self-hosted, blockchain, 8-cpu]
    permissions:
      contents: read
      id-token: write
      security-events: write
    steps:
      - uses: actions/checkout@v3
      - name: Login at GCP Artifact Registry
        # v1.12.3 is main at Oct 26, 2023
        uses: celo-org/reusable-workflows/.github/actions/auth-gcp-artifact-registry@v1.12.3
        with:
          workload-id-provider: 'projects/1094498259535/locations/global/workloadIdentityPools/gh-celo-blockchain-dev/providers/github-by-repos'
          service-account: 'celo-blockchain-dev@devopsre.iam.gserviceaccount.com'
          artifact-registry: us-west1-docker.pkg.dev/devopsre/dev-images/geth
      - name: Build and push container
        uses: celo-org/reusable-workflows/.github/actions/build-container@v1.12.3
        with:
          platforms: linux/amd64,linux/arm64
          registry: us-west1-docker.pkg.dev/devopsre/dev-images/geth
          tag: ${{ github.sha }}
          context: .
          dockerfile: Dockerfile
          push: ${{ fromJSON(true) }}
          load: ${{ fromJSON(false) }}

  build-container-geth-master:
    runs-on: [self-hosted, blockchain, 8-cpu]
    if: github.ref == 'refs/heads/master'
    permissions:
      contents: read
      id-token: write
      security-events: write
    steps:
      - uses: actions/checkout@v3
      - name: Login at GCP Artifact Registry
        uses: celo-org/reusable-workflows/.github/actions/auth-gcp-artifact-registry@v1.12.3
        with:
          workload-id-provider: 'projects/1094498259535/locations/global/workloadIdentityPools/gh-celo-blockchain/providers/github-by-repos'
          service-account: 'celo-blockchain@devopsre.iam.gserviceaccount.com'
          artifact-registry: us-west1-docker.pkg.dev/devopsre/celo-blockchain-public/geth
      - name: Build and push container
        uses: celo-org/reusable-workflows/.github/actions/build-container@v1.12.3
        with:
          platforms: linux/amd64,linux/arm64
          registry: us-west1-docker.pkg.dev/devopsre/dev-images/geth
          tag: master
          context: .
          dockerfile: Dockerfile
          push: ${{ fromJSON(true) }}
          load: ${{ fromJSON(false) }}

  build-container-geth-all-master:
    runs-on: [self-hosted, blockchain, 8-cpu]
    if: github.ref == 'refs/heads/master'
    permissions:
      contents: read
      id-token: write
      security-events: write
    steps:
      - uses: actions/checkout@v3
      - name: Login at GCP Artifact Registry
        uses: celo-org/reusable-workflows/.github/actions/auth-gcp-artifact-registry@v1.12.3
        with:
          workload-id-provider: 'projects/1094498259535/locations/global/workloadIdentityPools/gh-celo-blockchain/providers/github-by-repos'
          service-account: 'celo-blockchain@devopsre.iam.gserviceaccount.com'
          artifact-registry: us-west1-docker.pkg.dev/devopsre/celo-blockchain-public/geth-all
      - name: Build and push container
        uses: celo-org/reusable-workflows/.github/actions/build-container@v1.12.3
        with:
          platforms: linux/amd64,linux/arm64
          registry: us-west1-docker.pkg.dev/devopsre/dev-images/geth-all
          tag: master
          context: .
          dockerfile: Dockerfile.alltools
          push: ${{ fromJSON(true) }}
          load: ${{ fromJSON(false) }}