manually-build-unbound.yaml

name: Manually Build Distroless Unbound Docker Image

on:
  workflow_dispatch:
      
jobs:   
  buildvars:
    runs-on: ubuntu-latest
    outputs:
      IMAGE_BUILD_DATE: ${{ steps.IMPORT_BUILDVARS.outputs.IMAGE_BUILD_DATE }}
      UNBOUND_VERSION: ${{ steps.IMPORT_BUILDVARS.outputs.UNBOUND_VERSION }}
      UNBOUND_SHA256: ${{ steps.IMPORT_BUILDVARS.outputs.UNBOUND_SHA256 }}
      OPENSSL_BUILDENV_VERSION: ${{ steps.GET_OPENSSL_BUILDENV_VERSION.outputs.OPENSSL_BUILDENV_VERSION }}
      
    steps:            
      - name: Checkout source
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Import build variables from buildvars file
        id: IMPORT_BUILDVARS
        run: |
          echo IMAGE_BUILD_DATE=$(date -u) >> $GITHUB_OUTPUT
          cat buildvars | grep UNBOUND_VERSION >> $GITHUB_OUTPUT
          cat buildvars | grep UNBOUND_SHA256 >> $GITHUB_OUTPUT     

      - name: Get OpenSSL buildenv version
        id: GET_OPENSSL_BUILDENV_VERSION
        run: | 
          echo OPENSSL_BUILDENV_VERSION="$(curl -s https://api.github.com/repos/madnuttah/openssl-buildenv/releases | jq '.[0] | .name' -r)" >> $GITHUB_OUTPUT    
         
  build: 
    runs-on: ubuntu-latest    
    needs: buildvars
    steps:
      - name: Checkout source
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3
      
      - name: Set up Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@v3
     
      - name: Login to Dockerhub
        if: github.event_name != 'pull_request'
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
              
      - name: Build and push
        uses: docker/build-push-action@v5
        env:
          DOCKERHUB_SLUG: "madnuttah/unbound"
          UNBOUND_DOCKER_IMAGE_VERSION: "1.19.3-2"
        with:
          platforms: linux/386,linux/arm/v6,linux/arm/v7,linux/arm64,linux/amd64
          builder: ${{ steps.buildx.outputs.name }}
          build-args: |
            DOCKERHUB_SLUG=${{ env.DOCKERHUB_SLUG }} 
            UNBOUND_SHA256=${{ needs.buildvars.outputs.UNBOUND_SHA256 }}  
            IMAGE_BUILD_DATE=${{ needs.buildvars.outputs.IMAGE_BUILD_DATE}}
            UNBOUND_VERSION=${{ needs.buildvars.outputs.UNBOUND_VERSION }}  
            UNBOUND_DOCKER_IMAGE_VERSION=${{ env.UNBOUND_DOCKER_IMAGE_VERSION }}
            OPENSSL_BUILDENV_VERSION=${{ needs.buildvars.outputs.OPENSSL_BUILDENV_VERSION }}  
          file: ./unbound/release.Dockerfile   
          push: ${{ github.event_name != 'pull_request' }}
          sbom: ${{ github.event_name != 'pull_request' }}
          provenance: ${{ github.event_name != 'pull_request' }}
          tags: |
            ${{ env.DOCKERHUB_SLUG }}:${{ env.UNBOUND_DOCKER_IMAGE_VERSION }}      
            ${{ env.DOCKERHUB_SLUG }}:latest