zabbix-docker/.github/workflows/images_build_rhel.yml

name: Build images (RedHat)

on:
  release:
    types: [published]
  push:
    branches:
      - '[0-9]+.[0-9]+'
      - 'trunk'
    paths:
      - 'Dockerfiles/*/rhel/*'
      - 'build.json'
      - '!**/README.md'
      - '!**/README.html'
      - '.github/workflows/images_build_rhel.yml'
  workflow_dispatch:
    inputs:
      publish_images:
        description: 'Publish images'
        required: true
        default: false
        type: boolean
      trunk_version:
        description: 'Specify trunk major version'
        type: string

concurrency:
  group: rhel-build-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

defaults:
  run:
    shell: bash

permissions:
  contents: read

env:
  AUTO_PUSH_IMAGES: ${{ (! contains(fromJSON('["push"]'), github.event_name) && vars.AUTO_PUSH_IMAGES) || (contains(fromJSON('["workflow_dispatch"]'), github.event_name) && inputs.publish_images == 'true' ) }}
  LATEST_BRANCH: ${{ github.event.repository.default_branch }}

  IMAGES_PREFIX: "zabbix-"
  BASE_BUILD_NAME: "build-base"

  MATRIX_FILE: "build.json"
  DOCKERFILES_DIRECTORY: "Dockerfiles"

  REGISTRY: "quay.io"
  REGISTRY_NAMESPACE: "redhat-isv-containers"
  PREFLIGHT_IMAGE: "quay.io/opdev/preflight:stable"
  PFLT_LOGLEVEL: "warn"
  PFLT_ARTIFACTS: "/tmp/artifacts"
  IMAGE_DIR: "/tmp/images"

  RHEL_BUILD: "true"

jobs:
  init_build:
    name: Initialize build
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      platforms: ${{ steps.platform_list.outputs.list }}
      database: ${{ steps.database.outputs.list }}
      components: ${{ steps.components.outputs.list }}
      is_default_branch: ${{ steps.branch_info.outputs.is_default_branch }}
      current_branch: ${{ steps.branch_info.outputs.current_branch }}
      sha_short: ${{ steps.branch_info.outputs.sha_short }}
      secret_prefix: ${{ steps.branch_info.outputs.secret_prefix }}

    steps:
      - name: Block egress traffic
        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443
            github.com:443
            objects.githubusercontent.com:443
            release-assets.githubusercontent.com:443

      - name: Checkout repository
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          fetch-depth: 1
          sparse-checkout: |
            ${{ env.MATRIX_FILE }}
            .github

      - name: Check matrix file
        env:
          MATRIX_FILE: ${{ env.MATRIX_FILE }}
        run: |
          if [[ ! -f "$MATRIX_FILE" ]]; then
            echo "::error::File $MATRIX_FILE is missing"
            exit 1
          fi

      - name: Prepare platform list
        id: platform_list
        env:
          MATRIX_FILE: ${{ env.MATRIX_FILE }}
        run: |
          platform_list="$(jq -c '.["os-linux"].rhel' "$MATRIX_FILE")"

          echo "::group::Platform List"
          echo "$platform_list"
          echo "::endgroup::"

          echo "list=$platform_list" >> "$GITHUB_OUTPUT"

      - name: Prepare database engine list
        id: database
        env:
          MATRIX_FILE: ${{ env.MATRIX_FILE }}
        run: |
          database_list="$(jq -c '
            [.components
             | map_values(select(.rhel == true))
             | values[].base]
            | map(select(length > 0))
            | unique
          ' "$MATRIX_FILE")"

          echo "::group::Database List"
          echo "$database_list"
          echo "::endgroup::"

          echo "list=$database_list" >> "$GITHUB_OUTPUT"

      - name: Prepare Zabbix component list
        id: components
        env:
          MATRIX_FILE: ${{ env.MATRIX_FILE }}
        run: |
          component_list="$(jq -c '
            .components
            | map_values(select(.rhel == true))
            | keys
          ' "$MATRIX_FILE")"

          echo "::group::Zabbix Component List"
          echo "$component_list"
          echo "::endgroup::"

          echo "list=$component_list" >> "$GITHUB_OUTPUT"

      - name: Get branch info
        id: branch_info
        uses: ./.github/actions/get-branch-info
        with:
          trunk_version: ${{ inputs.trunk_version }}
          trunk_git_branch: ${{ env.TRUNK_GIT_BRANCH }}

  build_base:
    timeout-minutes: 30
    name: Build ${{ matrix.build }} base (${{ matrix.arch }})
    needs: ["init_build"]
    strategy:
      fail-fast: false
      matrix:
        build: [build-base]
        arch: ${{ fromJson(needs.init_build.outputs.platforms) }}
    runs-on: [self-hosted, linux, "${{ matrix.arch }}"]
    permissions:
      contents: read

    steps:
      - name: Checkout repository
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          fetch-depth: 1

      - name: Normalize architecture
        id: lc
        env:
          ARCH: ${{ matrix.arch }}
        run: |
          echo "arch=${ARCH,,}" >> "$GITHUB_OUTPUT"

      - name: Generate tags
        id: meta
        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
        with:
          images: ${{ env.IMAGES_PREFIX }}${{ matrix.build }}
          tags: |
            type=sha,suffix=-${{ steps.lc.outputs.arch }}

      - name: Build image
        id: build_image
        uses: redhat-actions/buildah-build@v2.13
        with:
          context: ${{ format('{0}/{1}/rhel', env.DOCKERFILES_DIRECTORY, matrix.build) }}
          layers: false
          tags: ${{ steps.meta.outputs.tags }}
          containerfiles: |
            ${{ env.DOCKERFILES_DIRECTORY }}/${{ matrix.build }}/rhel/Dockerfile
          extra-args: |
            --pull
            --iidfile=${{ github.workspace }}/iidfile

      - name: Save image metadata
        id: image_metadata
        env:
          IMAGE_TAG: ${{ steps.build_image.outputs.image-with-tag }}
          CACHE_FILE_NAME: ${{ env.BASE_BUILD_NAME }}_${{ matrix.arch }}
          IIDFILE: ${{ github.workspace }}/iidfile
        run: |
          [[ -f "$IIDFILE" ]] || { echo "::error::iidfile is missing: $IIDFILE"; exit 1; }

          TAG_ID="$(<"$IIDFILE")"

          echo "::group::Image metadata"
          echo "image_tag=$IMAGE_TAG"
          echo "tag_id=$TAG_ID"
          echo "cache_file_name=$CACHE_FILE_NAME"
          echo "::endgroup::"

          printf '%s' "$TAG_ID" > "${CACHE_FILE_NAME}_tag_id"
          printf '%s' "$IMAGE_TAG" > "${CACHE_FILE_NAME}_tag"

          echo "image_tag_id=$TAG_ID" >> "$GITHUB_OUTPUT"
          echo "image_tag=$IMAGE_TAG" >> "$GITHUB_OUTPUT"

      - name: Upload artifact metadata
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          path: |
            ${{ env.BASE_BUILD_NAME }}_${{ matrix.arch }}_tag_id
            ${{ env.BASE_BUILD_NAME }}_${{ matrix.arch }}_tag
          name: ${{ env.BASE_BUILD_NAME }}-${{ matrix.arch }}-${{ github.run_id }}

      - name: Push image to local storage
        id: push_image
        env:
          IMAGE_TAG: ${{ steps.image_metadata.outputs.image_tag }}
          IMAGE_TAG_ID: ${{ steps.image_metadata.outputs.image_tag_id }}
          IMAGE_DIR: ${{ env.IMAGE_DIR }}
          GITHUB_RUN_ID: ${{ github.run_id }}
        run: |
          [[ -n "$IMAGE_TAG" ]] || { echo "::error::IMAGE_TAG is empty"; exit 1; }
          [[ -n "$IMAGE_TAG_ID" ]] || { echo "::error::IMAGE_TAG_ID is empty"; exit 1; }
          [[ -n "$IMAGE_DIR" ]] || { echo "::error::IMAGE_DIR is empty"; exit 1; }

          run_dir="${IMAGE_DIR}/${GITHUB_RUN_ID}"
          rm -rf "$run_dir"
          mkdir -p "$run_dir"

          echo "::group::Result"
          echo "Image ${IMAGE_TAG} location: ${run_dir}/${IMAGE_TAG_ID}"
          podman push "${IMAGE_TAG}" "dir:${run_dir}/${IMAGE_TAG_ID}"
          echo "::endgroup::"

      - name: Post build cleanup
        if: ${{ success() || failure() }}
        env:
          IIDFILE: ${{ github.workspace }}/iidfile
        run: |
          echo "::group::Cleanup"

          rm -f "$IIDFILE"

          echo "Removing working containers"
          buildah rm -a 2>/dev/null || true

          echo "Removing container data in storage not controlled by podman"
          podman system prune --external 2>/dev/null || true

          echo "Removing unused container data"
          podman container prune -f 2>/dev/null || true
          podman image prune -f 2>/dev/null || true
          podman volume prune -f 2>/dev/null || true

          echo "::endgroup::"

      - name: Remove orphaned local image
        if: ${{ (cancelled() || failure()) && (steps.push_image.outcome == 'failure' || steps.push_image.outcome == 'cancelled') }}
        env:
          IMAGE_TAG_ID: ${{ steps.image_metadata.outputs.image_tag_id }}
          IMAGE_DIR: ${{ env.IMAGE_DIR }}
          GITHUB_RUN_ID: ${{ github.run_id }}
        run: |
          echo "::group::Removing orphaned image"
          rm -rf "${IMAGE_DIR:?}/${GITHUB_RUN_ID:?}/${IMAGE_TAG_ID:?}"
          echo "::endgroup::"

  build_base_database:
    timeout-minutes: 90
    needs: ["build_base", "init_build"]
    name: Build ${{ matrix.build }} base (${{ matrix.arch }})
    strategy:
      fail-fast: false
      matrix:
        build: ${{ fromJson(needs.init_build.outputs.database) }}
        arch: ${{ fromJson(needs.init_build.outputs.platforms) }}
    runs-on: [self-hosted, linux, "${{ matrix.arch }}"]
    permissions:
      contents: read

    steps:
      - name: Checkout repository
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          fetch-depth: 1

      - name: Normalize architecture
        id: lc
        env:
          ARCH: ${{ matrix.arch }}
        run: |
          echo "arch=${ARCH,,}" >> "$GITHUB_OUTPUT"

      - name: Download artifact metadata of ${{ env.BASE_BUILD_NAME }}:${{ matrix.arch }}
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: ${{ env.BASE_BUILD_NAME }}-${{ matrix.arch }}-${{ github.run_id }}

      - name: Pull ${{ env.BASE_BUILD_NAME }}:${{ matrix.arch }} image from local storage
        id: base_build
        env:
          MATRIX_ARCH: ${{ matrix.arch }}
          BASE_IMAGE: ${{ env.BASE_BUILD_NAME }}
          IMAGES_PREFIX: ${{ env.IMAGES_PREFIX }}
          IMAGE_DIR: ${{ env.IMAGE_DIR }}
          GITHUB_RUN_ID: ${{ github.run_id }}
        run: |
          tag_id_file="${BASE_IMAGE}_${MATRIX_ARCH}_tag_id"
          tag_file="${BASE_IMAGE}_${MATRIX_ARCH}_tag"

          [[ -f "$tag_id_file" ]] || { echo "::error::Missing file: $tag_id_file"; exit 1; }
          [[ -f "$tag_file" ]] || { echo "::error::Missing file: $tag_file"; exit 1; }
          [[ -n "$IMAGE_DIR" ]] || { echo "::error::IMAGE_DIR is empty"; exit 1; }

          BASE_TAG_ID="$(<"$tag_id_file")"
          BASE_IMAGE_TAG="$(<"$tag_file")"

          run_dir="${IMAGE_DIR}/${GITHUB_RUN_ID}"

          echo "::group::Pull image"
          echo "podman pull dir:${run_dir}/${BASE_TAG_ID}"
          podman pull "dir:${run_dir}/${BASE_TAG_ID}"
          echo "::endgroup::"

          echo "::group::Tag image"
          echo "podman tag ${BASE_TAG_ID} ${BASE_IMAGE_TAG}"
          podman tag "${BASE_TAG_ID}" "${BASE_IMAGE_TAG}"
          echo "::endgroup::"

          DIGEST="$(podman inspect "${BASE_TAG_ID}" --format '{{ .Digest }}')"
          [[ -n "$DIGEST" && "$DIGEST" != "<no value>" ]] || { echo "::error::Image digest is empty"; exit 1; }

          BASE_BUILD_IMAGE="${IMAGES_PREFIX}${BASE_IMAGE}@${DIGEST}"

          echo "::group::SHA256 tag"
          echo "base_build_image=${BASE_BUILD_IMAGE}"
          echo "::endgroup::"

          echo "base_build_image=${BASE_BUILD_IMAGE}" >> "$GITHUB_OUTPUT"

      - name: Generate tags
        id: meta
        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
        with:
          images: ${{ env.IMAGES_PREFIX }}${{ matrix.build }}
          tags: |
            type=sha,suffix=-${{ steps.lc.outputs.arch }}

      - name: Build image
        id: build_image
        uses: redhat-actions/buildah-build@v2.13
        with:
          context: ${{ format('{0}/{1}/rhel', env.DOCKERFILES_DIRECTORY, matrix.build) }}
          layers: false
          tags: ${{ steps.meta.outputs.tags }}
          containerfiles: |
            ${{ env.DOCKERFILES_DIRECTORY }}/${{ matrix.build }}/rhel/Dockerfile
          build-args: BUILD_BASE_IMAGE=localhost/${{ steps.base_build.outputs.base_build_image }}
          extra-args: |
            --iidfile=${{ github.workspace }}/iidfile
            --build-context sources=./sources/

      - name: Save image metadata
        id: image_metadata
        env:
          IMAGE_TAG: ${{ steps.build_image.outputs.image-with-tag }}
          CACHE_FILE_NAME: ${{ matrix.build }}_${{ matrix.arch }}
          IIDFILE: ${{ github.workspace }}/iidfile
        run: |
          [[ -f "$IIDFILE" ]] || { echo "::error::iidfile is missing: $IIDFILE"; exit 1; }

          TAG_ID="$(<"$IIDFILE")"

          echo "::group::Image metadata"
          echo "image_tag=$IMAGE_TAG"
          echo "tag_id=$TAG_ID"
          echo "cache_file_name=$CACHE_FILE_NAME"
          echo "::endgroup::"

          printf '%s' "$TAG_ID" > "${CACHE_FILE_NAME}_tag_id"
          printf '%s' "$IMAGE_TAG" > "${CACHE_FILE_NAME}_tag"

          echo "image_tag_id=$TAG_ID" >> "$GITHUB_OUTPUT"
          echo "image_tag=$IMAGE_TAG" >> "$GITHUB_OUTPUT"

      - name: Upload artifact metadata
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          path: |
            ${{ matrix.build }}_${{ matrix.arch }}_tag_id
            ${{ matrix.build }}_${{ matrix.arch }}_tag
          name: ${{ matrix.build }}-${{ matrix.arch }}-${{ github.run_id }}

      - name: Push image to local storage
        id: push_image
        env:
          IMAGE_TAG: ${{ steps.image_metadata.outputs.image_tag }}
          IMAGE_TAG_ID: ${{ steps.image_metadata.outputs.image_tag_id }}
          IMAGE_DIR: ${{ env.IMAGE_DIR }}
          GITHUB_RUN_ID: ${{ github.run_id }}
        run: |
          [[ -n "$IMAGE_TAG" ]] || { echo "::error::IMAGE_TAG is empty"; exit 1; }
          [[ -n "$IMAGE_TAG_ID" ]] || { echo "::error::IMAGE_TAG_ID is empty"; exit 1; }
          [[ -n "$IMAGE_DIR" ]] || { echo "::error::IMAGE_DIR is empty"; exit 1; }

          run_dir="${IMAGE_DIR}/${GITHUB_RUN_ID}"
          mkdir -p "$run_dir"

          echo "::group::Result"
          echo "Image ${IMAGE_TAG} location: ${run_dir}/${IMAGE_TAG_ID}"
          podman push "${IMAGE_TAG}" "dir:${run_dir}/${IMAGE_TAG_ID}"
          echo "::endgroup::"

      - name: Post build cleanup
        if: ${{ success() || failure() }}
        env:
          IIDFILE: ${{ github.workspace }}/iidfile
        run: |
          echo "::group::Cleanup"

          rm -f "$IIDFILE"

          echo "Removing working containers"
          buildah rm -a 2>/dev/null || true

          echo "Removing container data in storage not controlled by podman"
          podman system prune --external 2>/dev/null || true

          echo "Removing unused container data"
          podman container prune -f 2>/dev/null || true
          podman image prune -f 2>/dev/null || true
          podman volume prune -f 2>/dev/null || true

          echo "::endgroup::"

      - name: Remove orphaned local image
        if: ${{ (cancelled() || failure()) && (steps.push_image.outcome == 'failure' || steps.push_image.outcome == 'cancelled') }}
        env:
          IMAGE_TAG_ID: ${{ steps.image_metadata.outputs.image_tag_id }}
          IMAGE_DIR: ${{ env.IMAGE_DIR }}
          GITHUB_RUN_ID: ${{ github.run_id }}
        run: |
          echo "::group::Removing orphaned image"
          rm -rf "${IMAGE_DIR:?}/${GITHUB_RUN_ID:?}/${IMAGE_TAG_ID:?}"
          echo "::endgroup::"

  build_images:
    timeout-minutes: 30
    needs: ["build_base_database", "init_build"]
    name: Build ${{ matrix.build }} image (${{ matrix.arch }})
    strategy:
      fail-fast: false
      matrix:
        build: ${{ fromJson(needs.init_build.outputs.components) }}
        arch: ${{ fromJson(needs.init_build.outputs.platforms) }}
    runs-on: [self-hosted, linux, "${{ matrix.arch }}"]
    permissions:
      contents: read

    steps:
      - name: Checkout repository
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          fetch-depth: 1

      - name: Format variables
        id: var_format
        env:
          MATRIX_BUILD: ${{ matrix.build }}
        run: |
          matrix_build="${MATRIX_BUILD^^}"
          matrix_build="${matrix_build//-/_}"

          echo "::group::Result"
          echo "matrix_build=${matrix_build}"
          echo "::endgroup::"

          echo "matrix_build=${matrix_build}" >> "$GITHUB_OUTPUT"

      - name: Detect build base image
        id: build_base_image
        if: ${{ matrix.build != 'snmptraps' }}
        env:
          MATRIX_BUILD: ${{ matrix.build }}
          MATRIX_FILE: ${{ env.MATRIX_FILE }}
        run: |
          build_base="$(jq -r ".components.\"$MATRIX_BUILD\".base" "$MATRIX_FILE")"
          [[ -n "$build_base" && "$build_base" != "null" ]] || { echo "::error::Base image is not defined for $MATRIX_BUILD"; exit 1; }

          echo "::group::Base Build Image"
          echo "$build_base"
          echo "::endgroup::"

          echo "build_base=$build_base" >> "$GITHUB_OUTPUT"

      - name: Download artifact metadata of ${{ steps.build_base_image.outputs.build_base }}:${{ matrix.arch }}
        if: ${{ matrix.build != 'snmptraps' }}
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: ${{ steps.build_base_image.outputs.build_base }}-${{ matrix.arch }}-${{ github.run_id }}

      - name: Pull ${{ steps.build_base_image.outputs.build_base }}:${{ matrix.arch }} image
        id: base_build
        if: ${{ matrix.build != 'snmptraps' }}
        env:
          MATRIX_ARCH: ${{ matrix.arch }}
          BASE_IMAGE: ${{ steps.build_base_image.outputs.build_base }}
          IMAGES_PREFIX: ${{ env.IMAGES_PREFIX }}
          IMAGE_DIR: ${{ env.IMAGE_DIR }}
          GITHUB_RUN_ID: ${{ github.run_id }}
        run: |
          tag_id_file="${BASE_IMAGE}_${MATRIX_ARCH}_tag_id"
          tag_file="${BASE_IMAGE}_${MATRIX_ARCH}_tag"

          [[ -f "$tag_id_file" ]] || { echo "::error::Missing file: $tag_id_file"; exit 1; }
          [[ -f "$tag_file" ]] || { echo "::error::Missing file: $tag_file"; exit 1; }
          [[ -n "$IMAGE_DIR" ]] || { echo "::error::IMAGE_DIR is empty"; exit 1; }

          base_tag_id="$(<"$tag_id_file")"
          base_image_tag="$(<"$tag_file")"

          run_dir="${IMAGE_DIR}/${GITHUB_RUN_ID}"

          echo "::group::Pull image"
          echo "podman pull dir:${run_dir}/${base_tag_id}"
          podman pull "dir:${run_dir}/${base_tag_id}"
          echo "::endgroup::"

          echo "::group::Tag image"
          echo "podman tag ${base_tag_id} ${base_image_tag}"
          podman tag "${base_tag_id}" "${base_image_tag}"
          echo "::endgroup::"

          digest="$(podman inspect "${base_tag_id}" --format '{{ .Digest }}')"
          [[ -n "$digest" && "$digest" != "<no value>" ]] || { echo "::error::Image digest is empty"; exit 1; }

          base_build_image="${IMAGES_PREFIX}${BASE_IMAGE}@${digest}"

          echo "::group::SHA256 tag"
          echo "digest=${base_build_image}"
          echo "::endgroup::"

          echo "base_build_image=${base_build_image}" >> "$GITHUB_OUTPUT"

      - name: Generate tags
        id: meta
        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
        with:
          images: ${{ env.REGISTRY }}/${{ env.REGISTRY_NAMESPACE }}/${{ secrets[format('{0}_{1}_PROJECT', needs.init_build.outputs.secret_prefix, steps.var_format.outputs.matrix_build)] || matrix.build }}
          tags: |
            type=semver,pattern={{version}}
            type=sha
          flavor: |
            latest=${{ github.event_name == 'release' }}
            suffix=${{ matrix.arch == 'ARM64' && '-arm64' || '' }},onlatest=true

      - name: Build image
        id: build_image
        uses: redhat-actions/buildah-build@v2.13
        with:
          context: ${{ format('{0}/{1}/rhel', env.DOCKERFILES_DIRECTORY, matrix.build) }}
          layers: false
          tags: ${{ steps.meta.outputs.tags }}
          labels: |
            org.opencontainers.image.revision=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }}
            org.opencontainers.image.created=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.created'] }}
          containerfiles: |
            ${{ env.DOCKERFILES_DIRECTORY }}/${{ matrix.build }}/rhel/Dockerfile
          extra-args: |
            --iidfile=${{ github.workspace }}/iidfile
          build-args: |
            BUILD_BASE_IMAGE=${{ matrix.build != 'snmptraps' && format('localhost/{0}', steps.base_build.outputs.base_build_image) || '' }}

      - name: Validate registry secrets
        if: ${{ env.AUTO_PUSH_IMAGES == 'true' }}
        env:
          PROJECT_NAME: ${{ secrets[format('{0}_{1}_PROJECT', needs.init_build.outputs.secret_prefix, steps.var_format.outputs.matrix_build)] }}
          PROJECT_SECRET: ${{ secrets[format('{0}_{1}_SECRET', needs.init_build.outputs.secret_prefix, steps.var_format.outputs.matrix_build)] }}
        run: |
          [[ -n "${PROJECT_NAME:-}" ]] || { echo "::error::Registry project secret is missing"; exit 1; }
          [[ -n "${PROJECT_SECRET:-}" ]] || { echo "::error::Registry robot secret is missing"; exit 1; }

      - name: Log in to ${{ env.REGISTRY }}
        uses: redhat-actions/podman-login@9184318aae1ee5034fbfbacc0388acf12669171f # v1.6
        if: ${{ env.AUTO_PUSH_IMAGES == 'true' }}
        with:
          username: ${{ format('redhat-isv-containers+{0}-robot', secrets[format('{0}_{1}_PROJECT', needs.init_build.outputs.secret_prefix, steps.var_format.outputs.matrix_build)]) }}
          password: ${{ secrets[format('{0}_{1}_SECRET', needs.init_build.outputs.secret_prefix, steps.var_format.outputs.matrix_build)] }}
          registry: ${{ env.REGISTRY }}
          auth_file_path: /tmp/.docker_${{ matrix.build }}_${{ matrix.arch }}_${{ needs.init_build.outputs.sha_short }}

      - name: Push to RedHat certification procedure (1st)
        id: push_to_registry
        if: ${{ env.AUTO_PUSH_IMAGES == 'true' }}
        uses: redhat-actions/push-to-registry@9986a6552bc4571882a4a67e016b17361412b4df # v2.7.1
        with:
          tags: ${{ steps.meta.outputs.tags }}

      - name: Preflight certification
        if: ${{ env.AUTO_PUSH_IMAGES == 'true' }}
        env:
          PFLT_DOCKERCONFIG: /tmp/.docker_${{ matrix.build }}_${{ matrix.arch }}_${{ needs.init_build.outputs.sha_short }}
          PFLT_CERTIFICATION_PROJECT_ID: ${{ secrets[format('{0}_{1}_PROJECT', needs.init_build.outputs.secret_prefix, steps.var_format.outputs.matrix_build)] }}
          PFLT_PYXIS_API_TOKEN: ${{ secrets.REDHAT_API_TOKEN }}
          PFLT_ARTIFACTS: ${{ env.PFLT_ARTIFACTS }}
          PFLT_LOGLEVEL: ${{ env.PFLT_LOGLEVEL }}
          IMAGE_TAG: ${{ steps.build_image.outputs.image-with-tag }}
          PREFLIGHT_IMAGE: ${{ env.PREFLIGHT_IMAGE }}
        run: |
          mkdir -p "$PFLT_ARTIFACTS"

          echo "::group::Pull preflight image"
          podman pull "$PREFLIGHT_IMAGE"
          echo "::endgroup::"

          echo "::group::Perform certification tests"
          podman run \
            -it \
            --rm \
            --security-opt=label=disable \
            --env PFLT_LOGLEVEL="$PFLT_LOGLEVEL" \
            --env PFLT_ARTIFACTS=/artifacts \
            --env PFLT_LOGFILE=/artifacts/preflight.log \
            --env PFLT_CERTIFICATION_COMPONENT_ID="$PFLT_CERTIFICATION_PROJECT_ID" \
            --env PFLT_PYXIS_API_TOKEN="$PFLT_PYXIS_API_TOKEN" \
            --env PFLT_DOCKERCONFIG=/temp-authfile.json \
            -v "$PFLT_ARTIFACTS:/artifacts" \
            -v "$PFLT_DOCKERCONFIG:/temp-authfile.json:ro" \
            "$PREFLIGHT_IMAGE" check container "$IMAGE_TAG" --submit
          echo "::endgroup::"

      - name: Push to RedHat certification procedure (all tags)
        id: push_to_registry_all_tags
        if: ${{ env.AUTO_PUSH_IMAGES == 'true' }}
        uses: redhat-actions/push-to-registry@9986a6552bc4571882a4a67e016b17361412b4df # v2.7.1
        with:
          tags: ${{ steps.meta.outputs.tags }}

      - name: Post preflight cleanup
        if: ${{ env.AUTO_PUSH_IMAGES == 'true' && (success() || failure()) }}
        env:
          PREFLIGHT_IMAGE: ${{ env.PREFLIGHT_IMAGE }}
          PFLT_ARTIFACTS: ${{ env.PFLT_ARTIFACTS }}
        run: |
          echo "::group::Cleanup"
          rm -rf "$PFLT_ARTIFACTS"
          podman rmi -i -f "$PREFLIGHT_IMAGE" 2>/dev/null || true
          echo "::endgroup::"

      - name: Image digest
        env:
          IIDFILE: ${{ github.workspace }}/iidfile
        run: |
          [[ -f "$IIDFILE" ]] || { echo "::error::iidfile is missing: $IIDFILE"; exit 1; }
          tag_id="$(<"$IIDFILE")"

          echo "::group::Image digest"
          echo "$tag_id"
          echo "::endgroup::"

      - name: Post build cleanup
        if: ${{ success() || failure() }}
        env:
          IIDFILE: ${{ github.workspace }}/iidfile
        run: |
          echo "::group::Cleanup"

          rm -f "$IIDFILE"

          echo "Removing working containers"
          buildah rm -a 2>/dev/null || true

          echo "Removing container data in storage not controlled by podman"
          podman system prune --external 2>/dev/null || true

          echo "Removing unused container data"
          podman container prune -f 2>/dev/null || true
          podman image prune -f 2>/dev/null || true
          podman volume prune -f 2>/dev/null || true

          echo "::endgroup::"

  clear_artifacts:
    timeout-minutes: 10
    needs: ["build_images", "build_base_database", "init_build"]
    name: Clear images cache (${{ matrix.arch }})
    strategy:
      fail-fast: false
      matrix:
        arch: ${{ fromJson(needs.init_build.outputs.platforms) }}
    runs-on: [self-hosted, linux, "${{ matrix.arch }}"]
    if: ${{ needs.build_base_database.result == 'success' }}
    permissions: {}

    steps:
      - name: Remove local image storage for current run
        if: ${{ always() }}
        env:
          IMAGE_DIR: ${{ env.IMAGE_DIR }}
          GITHUB_RUN_ID: ${{ github.run_id }}
        run: |
          set -u

          run_dir="${IMAGE_DIR}/${GITHUB_RUN_ID}"

          echo "::group::Cleanup run storage"
          if [[ -d "$run_dir" ]]; then
            echo "Removing $run_dir"
            rm -rf "${run_dir:?}"
          else
            echo "Run directory does not exist: $run_dir"
          fi
          echo "::endgroup::"