push-kbs-client-to-ghcr.yml

name: Build and Push kbs-client

on:
  push:
    branches:
      - main

jobs:
  build_and_push:
    strategy:
      fail-fast: false
      matrix:
        arch:
          - x86_64
          - s390x
          - aarch64
    runs-on: ${{ matrix.arch == 's390x' && 's390x' || 'ubuntu-22.04' }}
    permissions:
      contents: read
      packages: write

    steps:
    - name: Check out code
      uses: actions/checkout@v4

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3

    - name: Log in to ghcr.io
      uses: docker/login-action@v3
      with:
        registry: ghcr.io
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}

    - name: Build a statically linked kbs-client for ${{ matrix.arch }} linux
      run: |
        docker buildx build -f kbs/docker/kbs-client/Dockerfile \
          --build-arg ARCH="${{ matrix.arch }}" --output ./ .

    - name: Push to ghcr.io
      run: |
        commit_sha=${{ github.sha }}
        oras push \
          ghcr.io/confidential-containers/staged-images/kbs-client:sample_only-${{ matrix.arch }}-linux-gnu-${commit_sha},latest-${{ matrix.arch }} \
          kbs-client
        if [ "${{ matrix.arch }}" = "x86_64" ]; then
          oras push ghcr.io/confidential-containers/staged-images/kbs-client:latest kbs-client
        fi