# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

name: Docker Build

on:
  workflow_call:
    inputs:
      component:
        required: true
        type: string
      binary:
        required: true
        type: string
      target-suffix:
        required: true
        type: string
      image-tag:
        required: false
        type: string
        default: ""
      checkout-ref:
        required: false
        type: string
        default: ""

permissions:
  contents: read
  packages: write

jobs:
  build:
    name: ${{ inputs.component }} (${{ matrix.platform }})
    strategy:
      fail-fast: false
      matrix:
        include:
          - arch: amd64
            rust_arch: x86_64
            platform: linux/amd64
            runner: linux-amd64-cpu8
          - arch: arm64
            rust_arch: aarch64
            platform: linux/arm64
            runner: linux-arm64-cpu8
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ inputs['checkout-ref'] || github.sha }}

      - uses: ./.github/actions/build-docker-image
        with:
          component: ${{ inputs.component }}
          binary: ${{ inputs.binary }}
          triple: ${{ matrix.rust_arch }}-${{ inputs['target-suffix'] }}
          arch: ${{ matrix.arch }}
          platform: ${{ matrix.platform }}
          image-tag: ${{ inputs.image-tag || github.sha }}
          github-token: ${{ secrets.GITHUB_TOKEN }}

  manifest:
    name: ${{ inputs.component }} manifest
    needs: build
    runs-on: linux-amd64-cpu8
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ inputs['checkout-ref'] || github.sha }}

      - name: Log in to GHCR
        shell: bash
        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${GITHUB_ACTOR}" --password-stdin

      - name: Create manifest
        shell: bash
        env:
          IMAGE_TAG: ${{ inputs.image-tag || github.sha }}
          INPUTS_COMPONENT: ${{ inputs.component }}
        run: |
          image=ghcr.io/nvidia/openshell/${INPUTS_COMPONENT}
          docker buildx imagetools create \
            --prefer-index=false \
            --tag "$image:${IMAGE_TAG}" \
            "$image:${IMAGE_TAG}-amd64" \
            "$image:${IMAGE_TAG}-arm64"

      - name: Verify merged manifest SBOM attestation
        shell: bash
        env:
          IMAGE_REF: ghcr.io/nvidia/openshell/${{ inputs.component }}:${{ inputs.image-tag || github.sha }}
        run: tasks/scripts/verify-image-sbom.sh "${IMAGE_REF}" --require-cargo