reusable_publish_docker.yaml

# This is a reusable workflow used by master and release CI
on:
  workflow_call:
    inputs:
      tag:
        description: The tag to push
        required: true
        type: string
      is_latest:
        description: Update the latest tag with the new image
        required: false
        type: boolean
        default: false
      sign:
        description: Add signature with cosign
        required: false
        type: boolean
        default: false

permissions:
  contents: read

jobs:
  publish-docker:
    runs-on: ubuntu-latest

    permissions:
      attestations: write
      id-token: write
      contents: read

    steps:
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0

      - name: Download x86_64 images tarballs
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
        with:
          name: falco-images-x86_64
          path: /tmp/falco-images

      - name: Download aarch64 images tarballs
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
        with:
          name: falco-images-aarch64
          path: /tmp/falco-images

      - name: Load all images
        run: |
          for img in /tmp/falco-images/falco-*.tar; do docker load --input $img; done

      - name: Login to Docker Hub
        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
        with:
          username: ${{ secrets.DOCKERHUB_USER }}
          password: ${{ secrets.DOCKERHUB_SECRET }}

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@010d0da01d0b5a38af31e9c3470dbfdabdecca3a # v4.0.1
        with:
          role-to-assume: "arn:aws:iam::292999226676:role/github_actions-falco-ecr"
          aws-region: us-east-1 # The region must be set to us-east-1 in order to access ECR Public.

      - name: Login to Amazon ECR
        id: login-ecr-public
        uses: aws-actions/amazon-ecr-login@2f9f10ea3fa2eed41ac443fee8bfbd059af2d0a4 # v1.6.0
        with:
          registry-type: public

      - name: Setup Crane
        uses: imjasonh/setup-crane@00c9e93efa4e1138c9a7a5c594acd6c75a2fbf0c # v0.3
        with:
          version: v0.15.1

      # We're pushing the arch-specific manifests to Docker Hub so that we'll be able to easily create the index/multiarch later
      - name: Push arch-specific images to Docker Hub
        run: |
          docker push docker.io/falcosecurity/falco:aarch64-${{ inputs.tag }}
          docker push docker.io/falcosecurity/falco:x86_64-${{ inputs.tag }}
          docker push docker.io/falcosecurity/falco:aarch64-${{ inputs.tag }}-debian
          docker push docker.io/falcosecurity/falco:x86_64-${{ inputs.tag }}-debian
          docker push docker.io/falcosecurity/falco-driver-loader:aarch64-${{ inputs.tag }}
          docker push docker.io/falcosecurity/falco-driver-loader:x86_64-${{ inputs.tag }}
          docker push docker.io/falcosecurity/falco-driver-loader:aarch64-${{ inputs.tag }}-buster
          docker push docker.io/falcosecurity/falco-driver-loader:x86_64-${{ inputs.tag }}-buster

      - name: Create Falco manifest on Docker Hub
        uses: Noelware/docker-manifest-action@8e337e3cb9656abfcf20146b99706fd88716e942 # v0.4.0
        with:
          inputs: docker.io/falcosecurity/falco:${{ inputs.tag }}
          images: docker.io/falcosecurity/falco:aarch64-${{ inputs.tag }},docker.io/falcosecurity/falco:x86_64-${{ inputs.tag }}
          push: true

      - name: Create falco-debian manifest on Docker Hub
        uses: Noelware/docker-manifest-action@8e337e3cb9656abfcf20146b99706fd88716e942 # v0.4.0
        with:
          inputs: docker.io/falcosecurity/falco:${{ inputs.tag }}-debian
          images: docker.io/falcosecurity/falco:aarch64-${{ inputs.tag }}-debian,docker.io/falcosecurity/falco:x86_64-${{ inputs.tag }}-debian
          push: true

      - name: Create falco-driver-loader manifest on Docker Hub
        uses: Noelware/docker-manifest-action@8e337e3cb9656abfcf20146b99706fd88716e942 # v0.4.0
        with:
          inputs: docker.io/falcosecurity/falco-driver-loader:${{ inputs.tag }}
          images: docker.io/falcosecurity/falco-driver-loader:aarch64-${{ inputs.tag }},docker.io/falcosecurity/falco-driver-loader:x86_64-${{ inputs.tag }}
          push: true

      - name: Create falco-driver-loader-buster manifest on Docker Hub
        uses: Noelware/docker-manifest-action@8e337e3cb9656abfcf20146b99706fd88716e942 # v0.4.0
        with:
          inputs: docker.io/falcosecurity/falco-driver-loader:${{ inputs.tag }}-buster
          images: docker.io/falcosecurity/falco-driver-loader:aarch64-${{ inputs.tag }}-buster,docker.io/falcosecurity/falco-driver-loader:x86_64-${{ inputs.tag }}-buster
          push: true

      - name: Get Digests for images
        id: digests
        # We could probably use the docker-manifest-action output instead of recomputing those with crane
        run: |
          echo "falco=$(crane digest docker.io/falcosecurity/falco:${{ inputs.tag }})" >> $GITHUB_OUTPUT
          echo "falco-debian=$(crane digest docker.io/falcosecurity/falco:${{ inputs.tag }}-debian)" >> $GITHUB_OUTPUT
          echo "falco-driver-loader=$(crane digest docker.io/falcosecurity/falco-driver-loader:${{ inputs.tag }})" >> $GITHUB_OUTPUT
          echo "falco-driver-loader-buster=$(crane digest docker.io/falcosecurity/falco-driver-loader:${{ inputs.tag }}-buster)" >> $GITHUB_OUTPUT

      - name: Publish images to ECR
        run: |
          crane copy docker.io/falcosecurity/falco:${{ inputs.tag }} public.ecr.aws/falcosecurity/falco:${{ inputs.tag }}
          crane copy docker.io/falcosecurity/falco:${{ inputs.tag }}-debian public.ecr.aws/falcosecurity/falco:${{ inputs.tag }}-debian
          crane copy docker.io/falcosecurity/falco-driver-loader:${{ inputs.tag }} public.ecr.aws/falcosecurity/falco-driver-loader:${{ inputs.tag }}
          crane copy docker.io/falcosecurity/falco-driver-loader:${{ inputs.tag }}-buster public.ecr.aws/falcosecurity/falco-driver-loader:${{ inputs.tag }}-buster

      - name: Tag latest on Docker Hub and ECR
        if: inputs.is_latest
        run: |
          crane tag docker.io/falcosecurity/falco:${{ inputs.tag }} latest
          crane tag docker.io/falcosecurity/falco:${{ inputs.tag }}-debian latest-debian
          crane tag docker.io/falcosecurity/falco-driver-loader:${{ inputs.tag }} latest
          crane tag docker.io/falcosecurity/falco-driver-loader:${{ inputs.tag }}-buster latest-buster

          crane tag public.ecr.aws/falcosecurity/falco:${{ inputs.tag }} latest
          crane tag public.ecr.aws/falcosecurity/falco:${{ inputs.tag }}-debian latest-debian
          crane tag public.ecr.aws/falcosecurity/falco-driver-loader:${{ inputs.tag }} latest
          crane tag public.ecr.aws/falcosecurity/falco-driver-loader:${{ inputs.tag }}-buster latest-buster

      - name: Setup Cosign
        if: inputs.sign
        uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 # v3.5.0

      - name: Sign images with cosign
        if: inputs.sign
        env:
          COSIGN_EXPERIMENTAL: "true"
          COSIGN_YES: "true"
        run: |
          cosign sign docker.io/falcosecurity/falco:latest@${{ steps.digests.outputs.falco }}
          cosign sign docker.io/falcosecurity/falco:latest-debian@${{ steps.digests.outputs.falco-debian }}
          cosign sign docker.io/falcosecurity/falco-driver-loader:latest@${{ steps.digests.outputs.falco-driver-loader }}
          cosign sign docker.io/falcosecurity/falco-driver-loader:latest-buster@${{ steps.digests.outputs.falco-driver-loader-buster }}

          cosign sign public.ecr.aws/falcosecurity/falco:latest@${{ steps.digests.outputs.falco }}
          cosign sign public.ecr.aws/falcosecurity/falco:latest-debian@${{ steps.digests.outputs.falco-debian }}
          cosign sign public.ecr.aws/falcosecurity/falco-driver-loader:latest@${{ steps.digests.outputs.falco-driver-loader }}
          cosign sign public.ecr.aws/falcosecurity/falco-driver-loader:latest-buster@${{ steps.digests.outputs.falco-driver-loader-buster }}

      - uses: actions/attest-build-provenance@173725a1209d09b31f9d30a3890cf2757ebbff0d # v1.1.2
        with:
          subject-name: docker.io/falcosecurity/falco
          subject-digest: ${{ steps.digests.outputs.falco }}
          push-to-registry: true

      - uses: actions/attest-build-provenance@173725a1209d09b31f9d30a3890cf2757ebbff0d # v1.1.2
        with:
          subject-name: docker.io/falcosecurity/falco-driver-loader
          subject-digest: ${{ steps.digests.outputs.falco-driver-loader }}
          push-to-registry: true