build.yaml

name: Build

on:
  workflow_call:
    inputs:
      mode:
        required: true
        type: string
        default: snapshot
        description: |
          the mode to use. either `snapshot` or `release`. Will affect effective version, as well
          as target-oci-registry.

jobs:
  prepare:
    uses: gardener/cc-utils/.github/workflows/prepare.yaml@v1
    with:
      mode: ${{ inputs.mode }}
      version-commit-callback-action-path: ./.github/actions/prepare-release
    permissions:
      id-token: write

  diki-executables:
    name: Build Diki-Executables
    needs:
      - prepare
    permissions:
      contents: read
    strategy:
      matrix:
        args:
          - os: linux
            arch: amd64
            runner: ubuntu-latest
          - os: linux
            arch: arm64
            runner: ubuntu-24.04-arm
          - os: darwin
            arch: amd64
            runner: ubuntu-latest
          - os: darwin
            arch: arm64
            runner: ubuntu-24.04-arm
          - os: windows
            arch: amd64
            runner: ubuntu-latest
    runs-on: ${{ matrix.args.runner }}
    steps:
      - uses: gardener/cc-utils/.github/actions/trusted-checkout@v1
      - uses: gardener/cc-utils/.github/actions/import-commit@v1
        with:
          commit-objects-artefact: ${{ needs.prepare.outputs.version-commit-artefact }}
          after-import: rebase
      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16  # v6.5.0
        with:
          go-version: '1.26'
      - name: build-diki
        shell: bash
        run: |
          set -euo pipefail

          mkdir /tmp/blobs.d
          os=${{ matrix.args.os }}
          arch=${{ matrix.args.arch }}
          extension=${{ matrix.args.os == 'windows' && '.exe' || '' }}

          CGO_ENABLED=0 \
          GOOS=${{ matrix.args.os }} \
          GOARCH=${{ matrix.args.arch }} \
          GO111MODULE=on \
            go build \
              -ldflags "$(hack/get-build-ld-flags.sh)" \
              -o "/tmp/blobs.d/diki-${os}-${arch}${extension}"  \
              cmd/diki/main.go
      - uses: gardener/cc-utils/.github/actions/export-ocm-fragments@v1
        with:
          blobs-directory: /tmp/blobs.d
          ocm-resources: |
            name: diki
            relation: local
            type: executable
            extraIdentity:
              os: ${{ matrix.args.os }}
              architecture: ${{ matrix.args.arch }}
            access:
              type: localBlob
              localReference: diki-${{ matrix.args.os }}-${{ matrix.args.arch }}${{ matrix.args.os == 'windows' && '.exe' || '' }}

  oci-images:
    name: Build OCI-Images
    needs:
      - prepare
    permissions:
      contents: read
      packages: write
      id-token: write
    secrets: inherit
    uses: gardener/cc-utils/.github/workflows/oci-ocm.yaml@v1
    strategy:
      matrix:
        args:
          - name: diki # the image used to run diki
            target: diki
            oci-repository: gardener/diki
            ocm-labels:
              name: gardener.cloud/cve-categorisation
              value:
                network_exposure: protected
                authentication_enforced: false
                user_interaction: end-user
                confidentiality_requirement: high
                integrity_requirement: high
                availability_requirement: none
          - name: diki-ops # used for the privileged pods created by diki on evaluated clusters.
                           # minimised image mainly used to run `chroot`, `nerdctl`
            target: diki-ops
            oci-repository: gardener/diki-ops
            ocm-labels:
              name: gardener.cloud/cve-categorisation
              value:
                network_exposure: private
                authentication_enforced: false
                user_interaction: end-user
                confidentiality_requirement: high
                integrity_requirement: high
                availability_requirement: none
    with:
      name: ${{ matrix.args.name }}
      version: ${{ needs.prepare.outputs.version }}
      target: ${{ matrix.args.target }}
      oci-registry: ${{ needs.prepare.outputs.oci-registry }}
      oci-repository: ${{ matrix.args.oci-repository }}
      oci-platforms: linux/amd64,linux/arm64
      ocm-labels: ${{ toJSON(matrix.args.ocm-labels) }}

  verify:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16  # v6.5.0
        with:
          go-version: '1.26'
      - uses: gardener/cc-utils/.github/actions/trusted-checkout@v1
      - uses: gardener/cc-utils/.github/actions/setup-git-identity@v1
      - name: run-verify
        run: |
          set -euo pipefail
          mkdir /tmp/blobs.d
          make verify-extended |& tee /tmp/blobs.d/verify-log.txt
          # verify calls `make sast-report`, which generates `gosec-report.sarif`
          tar czf /tmp/blobs.d/verify-log.tar.gz -C /tmp/blobs.d verify-log.txt
          tar czf /tmp/blobs.d/gosec-report.tar.gz gosec-report.sarif
      - name: add-reports-to-component-descriptor
        uses: gardener/cc-utils/.github/actions/export-ocm-fragments@v1
        with:
          blobs-directory: /tmp/blobs.d
          ocm-resources: |
            - name: gosec-report
              relation: local
              access:
                type: localBlob
                localReference: gosec-report.tar.gz
              labels:
                - name: gardener.cloud/purposes
                  value:
                    - lint
                    - sast
                    - gosec
                - name: gardener.cloud/comment
                  value: |
                    we use gosec (linter) for SAST scans
                    see: https://github.com/securego/gosec
                    Enabled by https://github.com/gardener/diki/pull/333
            - name: test-results
              relation: local
              access:
                type: localBlob
                localReference: verify-log.tar.gz
              labels:
                - name: gardener.cloud/purposes
                  value:
                    - test