bunkerweb/.github/workflows/linux-build.yml

name: Build Linux package (REUSABLE)

on:
  workflow_call:
    inputs:
      RELEASE:
        required: true
        type: string
      LINUX:
        required: true
        type: string
      PACKAGE:
        required: true
        type: string
      PLATFORMS:
        required: true
        type: string
      TEST:
        required: false
        type: boolean
        default: false
    secrets:
      DOCKER_USERNAME:
        required: true
      DOCKER_TOKEN:
        required: true
      ARM_SSH_KEY:
        required: false
      ARM_SSH_IP:
        required: false
      ARM_SSH_CONFIG:
        required: false

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      # Prepare
      - name: Checkout source code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Replace VERSION
        if: inputs.RELEASE == 'testing' || inputs.RELEASE == 'dev' || inputs.RELEASE == 'ui'
        run: chmod +x ./misc/update-version.sh && ./misc/update-version.sh ${{ inputs.RELEASE }}
      - name: Replace VERSION 1.5
        if: inputs.RELEASE == '1.5'
        run: chmod +x ./misc/update-version.sh && ./misc/update-version.sh 1.5-dev
      - name: Extract arch
        run: |
          echo "ARCH=${{ env.PLATFORMS }}" | sed 's/linux//g' | sed 's@/@@g' >> "$GITHUB_ENV"          
        env:
          PLATFORMS: ${{ inputs.PLATFORMS }}
      - name: Extract linux arch
        if: inputs.PACKAGE == 'rpm'
        run: |
          echo "LARCH=${{ env.ARCH }}" | sed 's/amd64/x86_64/g' | sed 's/arm64/aarch64/g' >> "$GITHUB_ENV"          
        env:
          ARCH: ${{ env.ARCH }}
      - name: Extract linux arch
        if: inputs.PACKAGE == 'deb'
        run: |
          echo "LARCH=${{ env.ARCH }}" >> "$GITHUB_ENV"          
        env:
          ARCH: ${{ env.ARCH }}
      - name: Setup SSH for ARM node
        if: startsWith(env.ARCH, 'arm') == true
        run: |
          mkdir -p ~/.ssh
          echo "$SSH_KEY" > ~/.ssh/id_rsa_arm
          chmod 600 ~/.ssh/id_rsa_arm
          echo "$SSH_CONFIG" | sed "s/SSH_IP/$SSH_IP/g" > ~/.ssh/config
          # Enhanced keepalive and timeout settings for long-running builds
          cat >> ~/.ssh/config << 'EOF'
          ServerAliveInterval 15
          ServerAliveCountMax 20
          TCPKeepAlive yes
          ConnectTimeout 30
          ConnectionAttempts 3
          ControlMaster auto
          ControlPath ~/.ssh/control-%C
          ControlPersist 1h
          StrictHostKeyChecking no
          EOF          
        env:
          SSH_KEY: ${{ secrets.ARM_SSH_KEY }}
          SSH_IP: ${{ secrets.ARM_SSH_IP }}
          SSH_CONFIG: ${{ secrets.ARM_SSH_CONFIG }}
      - name: Setup Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
        if: startsWith(env.ARCH, 'arm') == false
      - name: Setup Buildx (ARM)
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
        if: startsWith(env.ARCH, 'arm') == true
        with:
          endpoint: ssh://root@arm
          platforms: linux/arm64,linux/arm/v7
      - name: Login to Docker Hub
        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_TOKEN }}
      - name: Login to ghcr
        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      # Build testing package image
      - name: Build package image
        if: inputs.RELEASE == 'testing' || inputs.RELEASE == 'dev' || inputs.RELEASE == 'ui' || inputs.RELEASE == '1.5'
        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
        with:
          context: .
          load: true
          file: src/linux/Dockerfile-${{ inputs.LINUX }}
          platforms: ${{ inputs.PLATFORMS }}
          tags: local/bunkerweb-${{ inputs.LINUX }}:latest
          cache-from: type=gha,scope=${{ inputs.LINUX }}-${{ inputs.RELEASE }}
          cache-to: type=gha,scope=${{ inputs.LINUX }}-${{ inputs.RELEASE }},mode=min
      # Build non-testing package image
      - name: Build package image
        if: inputs.RELEASE != 'testing' && inputs.RELEASE != 'dev' && inputs.RELEASE != 'ui' && inputs.RELEASE != '1.5'
        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
        with:
          context: .
          load: true
          file: src/linux/Dockerfile-${{ inputs.LINUX }}
          platforms: ${{ inputs.PLATFORMS }}
          tags: local/bunkerweb-${{ inputs.LINUX }}:latest
      # Generate package
      - name: Generate package
        if: startsWith(env.ARCH, 'arm') == false
        run: chmod +x ./src/linux/package.sh && ./src/linux/package.sh ${{ inputs.LINUX }} ${{ env.LARCH }}
        env:
          LARCH: ${{ env.LARCH }}
      - name: Generate package (ARM)
        if: startsWith(env.ARCH, 'arm') == true
        run: |
          # Transfer image and generate package
          docker save local/bunkerweb-${{ inputs.LINUX }}:latest | ssh -C root@arm docker load
          scp ./src/linux/package.sh root@arm:/opt/package_${{ inputs.LINUX }}.sh
          ssh root@arm chmod +x /opt/package_${{ inputs.LINUX }}.sh
          ssh root@arm /opt/package_${{ inputs.LINUX }}.sh ${{ inputs.LINUX }} ${{ env.LARCH }} "$(cat src/VERSION | tr -d '\n')"
          scp -r root@arm:/root/package-${{ inputs.LINUX }} ./package-${{ inputs.LINUX }}          
        env:
          LARCH: ${{ env.LARCH }}
      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: package-${{ inputs.LINUX }}-${{ env.LARCH }}
          path: package-${{ inputs.LINUX }}/*.${{ inputs.PACKAGE }}
      # Build test image
      - name: Extract metadata
        if: inputs.TEST == true
        id: meta
        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
        with:
          images: ghcr.io/bunkerity/${{ inputs.LINUX }}-tests:${{ inputs.RELEASE }}
      - name: Build test image
        if: inputs.TEST == true
        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
        with:
          context: .
          file: tests/linux/Dockerfile-${{ inputs.LINUX }}
          platforms: ${{ inputs.PLATFORMS }}
          push: true
          tags: ghcr.io/bunkerity/${{ inputs.LINUX }}-tests:${{ inputs.RELEASE }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha,scope=${{ inputs.LINUX }}-${{ inputs.RELEASE }}-tests
          cache-to: type=gha,scope=${{ inputs.LINUX }}-${{ inputs.RELEASE }}-tests,mode=min