falco/.github/workflows/reusable_build_docker.yaml

# This is a reusable workflow used by master and release CI
on:
  workflow_call:
    inputs:
      arch:
        description: x86_64 or aarch64
        required: true
        type: string
      bucket_suffix:
        description: bucket suffix for packages
        required: false
        default: ''
        type: string
      version:
        description: The Falco version to use when building images
        required: true
        type: string
      tag:
        description: The tag to use (e.g. "master" or "0.35.0")
        required: true
        type: string

# Here we just build all docker images as tarballs,
# then we upload all the tarballs to be later downloaded by reusable_publish_docker workflow.
# In this way, we don't need to publish any arch specific image,
# and this "build" workflow is actually only building images.

permissions:
  contents: read

jobs:
  build-docker:
    # See https://github.com/actions/runner/issues/409#issuecomment-1158849936
    runs-on: ${{ (inputs.arch == 'aarch64' && 'ubuntu-22.04-arm') || 'ubuntu-latest' }}
    env:
      TARGETARCH: ${{ (inputs.arch == 'aarch64' && 'arm64') || 'amd64' }}
    steps:
      - name: Checkout
        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0

      - name: Build falco image
        run: |
          docker build -f docker/falco/Dockerfile -t docker.io/falcosecurity/falco:${{ inputs.arch }}-${{ inputs.tag }} \
            --build-arg VERSION_BUCKET=bin${{ inputs.bucket_suffix }} \
            --build-arg FALCO_VERSION=${{ inputs.version }} \
            --build-arg TARGETARCH=${TARGETARCH} \
            .
            docker save docker.io/falcosecurity/falco:${{ inputs.arch }}-${{ inputs.tag }} --output /tmp/falco-${{ inputs.arch }}.tar

      - name: Build falco-debian image
        run: |
          docker build -f docker/falco-debian/Dockerfile -t docker.io/falcosecurity/falco:${{ inputs.arch }}-${{ inputs.tag }}-debian \
            --build-arg VERSION_BUCKET=deb${{ inputs.bucket_suffix }} \
            --build-arg FALCO_VERSION=${{ inputs.version }} \
            --build-arg TARGETARCH=${TARGETARCH} \
            .
            docker save docker.io/falcosecurity/falco:${{ inputs.arch }}-${{ inputs.tag }}-debian --output /tmp/falco-${{ inputs.arch }}-debian.tar

      - name: Build falco-driver-loader image
        run: |
          docker build -f docker/driver-loader/Dockerfile -t docker.io/falcosecurity/falco-driver-loader:${{ inputs.arch }}-${{ inputs.tag }} \
            --build-arg FALCO_IMAGE_TAG=${{ inputs.arch }}-${{ inputs.tag }} \
            --build-arg TARGETARCH=${TARGETARCH} \
            .
            docker save docker.io/falcosecurity/falco-driver-loader:${{ inputs.arch }}-${{ inputs.tag }} --output /tmp/falco-driver-loader-${{ inputs.arch }}.tar

      - name: Build falco-driver-loader-buster image
        run: |
          docker build -f docker/driver-loader-buster/Dockerfile -t docker.io/falcosecurity/falco-driver-loader:${{ inputs.arch }}-${{ inputs.tag }}-buster \
            --build-arg VERSION_BUCKET=deb${{ inputs.bucket_suffix }} \
            --build-arg FALCO_VERSION=${{ inputs.version }} \
            --build-arg TARGETARCH=${TARGETARCH} \
            .
            docker save docker.io/falcosecurity/falco-driver-loader:${{ inputs.arch }}-${{ inputs.tag }}-buster --output /tmp/falco-driver-loader-${{ inputs.arch }}-buster.tar

      - name: Upload images tarballs
        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
        with:
          name: falco-images-${{ inputs.arch }}
          path: /tmp/falco-*.tar
          retention-days: 1