Merge pull request #693 from rossoctl/fix/build-args-duplicate-key #275

Workflow file for this run

	name: Build-Publish

	on:
	# Trigger on tags like v1.0.0
	push:
	tags:
	- 'v*'
	# Trigger on PR merges to main
	branches:
	- main
	# Allow manual trigger
	workflow_dispatch:

	permissions:
	contents: read
	packages: write

	jobs:
	build-and-push:
	runs-on: ubuntu-latest

	strategy:
	matrix:
	image_config:
	# iptables init container — used by envoy-sidecar mode to
	# set up traffic redirection. Proxy-sidecar mode does not
	# need this (HTTP_PROXY env var routing replaces iptables).
	- name: proxy-init
	context: ./authbridge/proxy-init
	dockerfile: Dockerfile.init

	# AuthBridge envoy-sidecar combined image —
	# Envoy + authbridge-envoy (ext_proc) + spiffe-helper.
	# Spiffe-helper starts conditionally based on SPIRE_ENABLED.
	- name: authbridge-envoy
	context: ./authbridge
	dockerfile: cmd/authbridge-envoy/Dockerfile

	# AuthBridge proxy-sidecar combined image (default mode) —
	# authbridge-proxy (full plugin set, includes parsers) +
	# spiffe-helper. No Envoy, no gRPC. Spiffe-helper starts
	# conditionally based on SPIRE_ENABLED.
	- name: authbridge
	context: ./authbridge
	dockerfile: cmd/authbridge-proxy/Dockerfile

	# AuthBridge proxy-sidecar LITE image — the SAME authbridge-proxy
	# binary + Dockerfile, built with exclude_plugin_* tags so only
	# jwt-validation + token-exchange compile in (drops the OPA SDK
	# and the parsers, roughly halving the binary). A build variant,
	# not a separate binary. Same listener layout as the full proxy
	# image; not yet referenced by the operator's default config.
	- name: authbridge-lite
	context: ./authbridge
	dockerfile: cmd/authbridge-proxy/Dockerfile
	build_args: \|
	GO_BUILD_TAGS=exclude_plugin_a2aparser,exclude_plugin_ibac,exclude_plugin_inferenceparser,exclude_plugin_mcpparser,exclude_plugin_opa,exclude_plugin_sparc,exclude_plugin_tokenbroker

	# AuthBridge proxy-sidecar CPEX image — authbridge-proxy built
	# with -tags cpex (links libcpex_ffi.a from a pinned CPEX
	# release) so the `cpex` plugin routes hooks through the CPEX
	# framework (APL DSL + named CPEX policy plugins). Needs the
	# CPEX_FFI_VERSION build-arg, read from the CPEX_FFI_VERSION
	# file in the build step below.
	- name: authbridge-cpex
	context: ./authbridge
	dockerfile: cmd/authbridge-cpex/Dockerfile

	# SPARC reflection service — the backend the `sparc` plugin calls.
	# Deployed once per cluster via authbridge/sparc-service/deploy.
	- name: sparc-service
	context: ./authbridge/sparc-service
	dockerfile: Dockerfile

	steps:
	# 1. Checkout code
	- name: Checkout repository
	uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

	# 2. Set up QEMU for multi-arch builds
	- name: Set up QEMU
	uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4

	# 3. Set up Docker Buildx
	- name: Set up Docker Buildx
	uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4

	# 4. Log in to GitHub Container Registry
	- name: Log in to ghcr.io
	uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
	with:
	registry: ghcr.io
	username: ${{ github.actor }}
	password: ${{ secrets.GITHUB_TOKEN }}

	# 5. Generate image tag
	- name: Generate image tag
	id: tag
	run: \|
	if [[ "${{ github.ref_type }}" == "tag" ]]; then
	echo "tag=${{ github.ref_name }}" >> $GITHUB_OUTPUT
	else
	# Use branch name or 'manual' for workflow_dispatch
	BRANCH="${{ github.ref_name }}"
	# Sanitize branch name (replace / with -)
	BRANCH="${BRANCH//\//-}"
	echo "tag=${BRANCH}-$(echo ${{ github.sha }} \| cut -c1-7)" >> $GITHUB_OUTPUT
	fi

	# 6. Extract Docker metadata
	- name: Extract Docker metadata
	id: meta
	uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
	with:
	images: ghcr.io/${{ github.repository }}/${{ matrix.image_config.name }}
	tags: \|
	# Always use the computed tag
	type=raw,value=${{ steps.tag.outputs.tag }}
	# Add 'latest' tag for version tags, workflow_dispatch, and pushes to main
	type=raw,value=latest,enable=${{ (github.ref_type == 'tag' && startsWith(github.ref_name, 'v')) \|\| github.event_name == 'workflow_dispatch' \|\| github.ref == 'refs/heads/main' }}

	# 6b. Resolve build-args. authbridge-cpex needs CPEX_FFI_VERSION
	# (the release tag) and CPEX_FFI_ABI (the FFI ABI integer the
	# linked lib must report) — both read from the files next to its
	# Dockerfile and asserted against the tarball at build time. Other
	# images leave this empty (an undeclared build-arg is ignored).
	- name: Resolve build args
	id: buildargs
	run: \|
	if [[ "${{ matrix.image_config.name }}" == "authbridge-cpex" ]]; then
	VERSION="$(tr -d '[:space:]' < authbridge/cmd/authbridge-cpex/CPEX_FFI_VERSION)"
	ABI="$(tr -d '[:space:]' < authbridge/cmd/authbridge-cpex/CPEX_FFI_ABI)"
	{
	echo "args<<EOF"
	echo "CPEX_FFI_VERSION=${VERSION}"
	echo "CPEX_FFI_ABI=${ABI}"
	echo "EOF"
	} >> "$GITHUB_OUTPUT"
	else
	echo "args=" >> "$GITHUB_OUTPUT"
	fi

	# 7. Build and push image
	- name: Build and push ${{ matrix.image_config.name }}
	uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7
	with:
	context: ${{ matrix.image_config.context }}
	file: ${{ matrix.image_config.context }}/${{ matrix.image_config.dockerfile }}
	# Merge both build-arg sources into a single key: static per-image
	# args from the matrix (e.g. authbridge-lite GO_BUILD_TAGS) plus the
	# dynamically resolved args (authbridge-cpex CPEX_FFI_*). A duplicate
	# `build-args:` key is invalid YAML and fails the whole workflow; only
	# one image sets each source, so concatenating them is safe.
	build-args: \|
	${{ matrix.image_config.build_args }}
	${{ steps.buildargs.outputs.args }}
	push: true
	platforms: linux/amd64,linux/arm64
	tags: ${{ steps.meta.outputs.tags }}
	labels: ${{ steps.meta.outputs.labels }}

Navigation Menu

Uh oh!

Merge pull request #693 from rossoctl/fix/build-args-duplicate-key #275

Workflow file

Merge pull request #693 from rossoctl/fix/build-args-duplicate-key #275

Uh oh!

Workflow file for this run