name: build

# Default to 'contents: read', which grants actions to read commits.
#
# If any permission is set, any permission not included in the list is
# implicitly set to "none".
#
# see https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

on:
  workflow_dispatch:
  push:
    branches:
      - 'master'
      - 'v[0-9]*'
    tags:
      - 'v*'
  pull_request:
    paths-ignore:
      - '.github/releases.json'
      - 'README.md'
      - 'docs/**'

env:
  SETUP_BUILDX_VERSION: "edge"
  SETUP_BUILDKIT_IMAGE: "moby/buildkit:latest"
  SCOUT_VERSION: "1.11.0"
  REPO_SLUG: "docker/buildx-bin"
  DESTDIR: "./bin"
  TEST_CACHE_SCOPE: "test"
  TESTFLAGS: "-v --parallel=6 --timeout=30m"
  GOTESTSUM_FORMAT: "standard-verbose"
  GO_VERSION: "1.25"
  GOTESTSUM_VERSION: "v1.13.0"  # same as one in Dockerfile

jobs:
  test-integration:
    runs-on: ubuntu-24.04
    env:
      TESTFLAGS_DOCKER: "-v --parallel=1 --timeout=30m"
      TEST_IMAGE_BUILD: "0"
      TEST_IMAGE_ID: "buildx-tests"
      TEST_COVERAGE: "1"
    strategy:
      fail-fast: false
      matrix:
        buildkit:
          - master
          - latest
          - buildx-stable-1
          - v0.26.3
          - v0.25.2
          - v0.24.0
        worker:
          - docker-container
          - remote
        pkg:
          - ./tests
        mode:
          - ""
          - experimental
        include:
          - worker: docker
            pkg: ./tests
          - worker: docker+containerd  # same as docker, but with containerd snapshotter
            pkg: ./tests
          - worker: docker
            pkg: ./tests
            mode: experimental
          - worker: docker+containerd  # same as docker, but with containerd snapshotter
            pkg: ./tests
            mode: experimental
          - worker: "docker@28.5"
            pkg: ./tests
          - worker: "docker+containerd@28.5"  # same as docker, but with containerd snapshotter
            pkg: ./tests
          - worker: "docker@28.5"
            pkg: ./tests
            mode: experimental
          - worker: "docker+containerd@28.5"  # same as docker, but with containerd snapshotter
            pkg: ./tests
            mode: experimental
          - worker: "docker@27.5"
            pkg: ./tests
          - worker: "docker+containerd@27.5"  # same as docker, but with containerd snapshotter
            pkg: ./tests
          - worker: "docker@27.5"
            pkg: ./tests
            mode: experimental
          - worker: "docker+containerd@27.5"  # same as docker, but with containerd snapshotter
            pkg: ./tests
            mode: experimental
    steps:
      -
        name: Prepare
        run: |
          echo "TESTREPORTS_NAME=${{ github.job }}-$(echo "${{ matrix.pkg }}-${{ matrix.buildkit }}-${{ matrix.worker }}-${{ matrix.mode }}" | tr -dc '[:alnum:]-\n\r' | tr '[:upper:]' '[:lower:]')" >> $GITHUB_ENV
          if [ -n "${{ matrix.buildkit }}" ]; then
            echo "TEST_BUILDKIT_TAG=${{ matrix.buildkit }}" >> $GITHUB_ENV
          fi
          testFlags="--run=//worker=$(echo "${{ matrix.worker }}" | sed 's/\+/\\+/g')$"
          case "${{ matrix.worker }}" in
            docker | docker+containerd | docker@* | docker+containerd@*)
              echo "TESTFLAGS=${{ env.TESTFLAGS_DOCKER }} $testFlags" >> $GITHUB_ENV
              ;;
            *)
              echo "TESTFLAGS=${{ env.TESTFLAGS }} $testFlags" >> $GITHUB_ENV
              ;;
          esac
          if [[ "${{ matrix.worker }}" == "docker"* ]]; then
            echo "TEST_DOCKERD=1" >> $GITHUB_ENV
          fi
          if [ "${{ matrix.mode }}" = "experimental" ]; then
            echo "TEST_BUILDX_EXPERIMENTAL=1" >> $GITHUB_ENV
          fi
      -
        name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
      -
        name: Set up QEMU
        uses: docker/setup-qemu-action@v3
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          version: ${{ env.SETUP_BUILDX_VERSION }}
          driver-opts: image=${{ env.SETUP_BUILDKIT_IMAGE }}
          buildkitd-flags: --debug
      -
        name: Build test image
        uses: docker/bake-action@v6
        with:
          source: .
          targets: integration-test
          set: |
            *.output=type=docker,name=${{ env.TEST_IMAGE_ID }}
      -
        name: Test
        run: |
          ./hack/test
        env:
          TEST_REPORT_SUFFIX: "-${{ env.TESTREPORTS_NAME }}"
          TESTPKGS: "${{ matrix.pkg }}"
      -
        name: Send to Codecov
        if: always()
        uses: codecov/codecov-action@v5
        with:
          directory: ./bin/testreports
          flags: integration
          token: ${{ secrets.CODECOV_TOKEN }}
          disable_file_fixes: true
      -
        name: Generate annotations
        if: always()
        uses: crazy-max/.github/.github/actions/gotest-annotations@fa6141aedf23596fb8bdcceab9cce8dadaa31bd9
        with:
          directory: ./bin/testreports
      -
        name: Upload test reports
        if: always()
        uses: actions/upload-artifact@v6
        with:
          name: test-reports-${{ env.TESTREPORTS_NAME }}
          path: ./bin/testreports

  test-unit:
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os:
          - ubuntu-24.04
          - macos-14
          - windows-2022
    env:
      SKIP_INTEGRATION_TESTS: 1
    steps:
      -
        name: Setup Git config
        run: |
          git config --global core.autocrlf false
          git config --global core.eol lf
      -
        name: Checkout
        uses: actions/checkout@v6
      -
        name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version: "${{ env.GO_VERSION }}"
      -
        name: Prepare
        run: |
          testreportsName=${{ github.job }}--${{ matrix.os }}
          testreportsBaseDir=./bin/testreports
          testreportsDir=$testreportsBaseDir/$testreportsName
          echo "TESTREPORTS_NAME=$testreportsName" >> $GITHUB_ENV
          echo "TESTREPORTS_BASEDIR=$testreportsBaseDir" >> $GITHUB_ENV
          echo "TESTREPORTS_DIR=$testreportsDir" >> $GITHUB_ENV
          mkdir -p $testreportsDir
        shell: bash
      -
        name: Install gotestsum
        run: |
          go install gotest.tools/gotestsum@${{ env.GOTESTSUM_VERSION }}
      -
        name: Test
        env:
          TMPDIR: ${{ runner.temp }}
        run: |
          gotestsum \
            --jsonfile="${{ env.TESTREPORTS_DIR }}/go-test-report.json" \
            --junitfile="${{ env.TESTREPORTS_DIR }}/junit-report.xml" \
            --packages="./..." \
            -- \
              "-mod=vendor" \
              "-coverprofile" "${{ env.TESTREPORTS_DIR }}/coverage.txt" \
              "-covermode" "atomic" ${{ env.TESTFLAGS }}
        shell: bash
      -
        name: Send to Codecov
        if: always()
        uses: codecov/codecov-action@v5
        with:
          directory: ${{ env.TESTREPORTS_DIR }}
          env_vars: RUNNER_OS
          flags: unit
          token: ${{ secrets.CODECOV_TOKEN }}
          disable_file_fixes: true
      -
        name: Generate annotations
        if: always()
        uses: crazy-max/.github/.github/actions/gotest-annotations@fa6141aedf23596fb8bdcceab9cce8dadaa31bd9
        with:
          directory: ${{ env.TESTREPORTS_DIR }}
      -
        name: Upload test reports
        if: always()
        uses: actions/upload-artifact@v6
        with:
          name: test-reports-${{ env.TESTREPORTS_NAME }}
          path: ${{ env.TESTREPORTS_BASEDIR }}

  test-bsd-unit:
    runs-on: ubuntu-22.04
    continue-on-error: true
    strategy:
      fail-fast: false
      matrix:
        os:
          - freebsd
          - netbsd
          - openbsd
    env:
      # https://github.com/hashicorp/vagrant/issues/13652
      VAGRANT_DISABLE_STRICT_DEPENDENCY_ENFORCEMENT: 1
    steps:
      -
        name: Prepare
        run: |
          echo "VAGRANT_FILE=hack/Vagrantfile.${{ matrix.os }}" >> $GITHUB_ENV
          
          # Sets semver Go version to be able to download tarball during vagrant setup
          goVersion=$(curl --silent "https://go.dev/dl/?mode=json&include=all" | jq -r '.[].files[].version' | uniq | sed -e 's/go//' | sort -V | grep $GO_VERSION | tail -1)
          echo "GO_VERSION=$goVersion" >> $GITHUB_ENV
      -
        name: Checkout
        uses: actions/checkout@v6
      -
        name: Cache Vagrant boxes
        uses: actions/cache@v5
        with:
          path: ~/.vagrant.d/boxes
          key: ${{ runner.os }}-vagrant-${{ matrix.os }}-${{ hashFiles(env.VAGRANT_FILE) }}
          restore-keys: |
            ${{ runner.os }}-vagrant-${{ matrix.os }}-
      -
        name: Install vagrant
        run: |
          set -x
          wget -O - https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg
          echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
          sudo apt-get update
          sudo apt-get install -y libvirt-dev libvirt-daemon libvirt-daemon-system vagrant vagrant-libvirt ruby-libvirt
          sudo systemctl enable --now libvirtd
          sudo chmod a+rw /var/run/libvirt/libvirt-sock
          vagrant plugin install vagrant-libvirt
          vagrant --version
      -
        name: Set up vagrant
        run: |
          ln -sf ${{ env.VAGRANT_FILE }} Vagrantfile
          vagrant up --no-tty
      -
        name: Test
        run: |
          vagrant ssh -- "cd /vagrant; SKIP_INTEGRATION_TESTS=1 go test -mod=vendor -coverprofile=coverage.txt -covermode=atomic ${{ env.TESTFLAGS }} ./..."
          vagrant ssh -c "sudo cat /vagrant/coverage.txt" > coverage.txt
      -
        name: Upload coverage
        if: always()
        uses: codecov/codecov-action@v5
        with:
          files: ./coverage.txt
          env_vars: RUNNER_OS
          flags: unit,${{ matrix.os }}
          token: ${{ secrets.CODECOV_TOKEN }}
        env:
          RUNNER_OS: ${{ matrix.os }}

  govulncheck:
    runs-on: ubuntu-24.04
    permissions:
      # same as global permission
      contents: read
      # required to write sarif report
      security-events: write
    steps:
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          version: ${{ env.SETUP_BUILDX_VERSION }}
          driver-opts: image=${{ env.SETUP_BUILDKIT_IMAGE }}
          buildkitd-flags: --debug
      -
        name: Run
        uses: docker/bake-action@v6
        with:
          targets: govulncheck
        env:
          GOVULNCHECK_FORMAT: sarif
      -
        name: Upload SARIF report
        if: ${{ github.ref == 'refs/heads/master' && github.repository == 'docker/buildx' }}
        uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: ${{ env.DESTDIR }}/govulncheck.out

  binaries:
    uses: docker/github-builder-experimental/.github/workflows/bake.yml@5876e8deef3c899c298ec80b07c43dd9e89d37f6
    permissions:
      contents: read # same as global permission
      id-token: write # for signing attestation(s) with GitHub OIDC Token
    with:
      runner: amd64
      artifact-name: buildx
      artifact-upload: true
      cache: true
      cache-scope: bin-image
      target: release
      output: local
      sbom: true
      sign: ${{ github.event_name != 'pull_request' }}

  binaries-finalize:
    runs-on: ubuntu-24.04
    needs:
      - binaries
    steps:
      -
        name: Download artifacts
        uses: actions/download-artifact@v6
        with:
          path: /tmp/buildx-output
          name: ${{ needs.binaries.outputs.artifact-name }}
      -
        name: Rename provenance and sbom
        run: |
          for pdir in /tmp/buildx-output/*/; do
            (
              cd "$pdir"
              binname=$(find . -name 'buildx-*')
              filename=$(basename "${binname%.exe}")
              mv "provenance.json" "${filename}.provenance.json"
              mv "sbom-binaries.spdx.json" "${filename}.sbom.json"
              find . -name 'sbom*.json' -exec rm {} \;
              if [ -f "provenance.sigstore.json" ]; then
                mv "provenance.sigstore.json" "${filename}.sigstore.json"
              fi
            )
          done
          mkdir -p "${{ env.DESTDIR }}"
          mv /tmp/buildx-output/**/* "${{ env.DESTDIR }}/"
      -
        name: Create checksums
        working-directory: ${{ env.DESTDIR }}
        run: |
          sha256sum -b buildx-* > ./checksums.txt
          sed -i '/darwin/d' ./checksums.txt
          sha256sum -c --strict checksums.txt
      -
        name: List artifacts
        working-directory: ${{ env.DESTDIR }}
        run: |
          tree -nh .
      -
        name: Check artifacts
        working-directory: ${{ env.DESTDIR }}
        run: |
          find . -type f -exec file -e ascii -- {} +
      -
        name: Upload release binaries
        uses: actions/upload-artifact@v6
        with:
          name: release
          path: ${{ env.DESTDIR }}/*
          if-no-files-found: error

  bin-image-prepare:
    runs-on: ubuntu-24.04
    outputs:
      repo-slug: ${{ env.REPO_SLUG }}
    steps:
      # FIXME: can't use env object in reusable workflow inputs: https://github.com/orgs/community/discussions/26671
      - run: echo "Exposing env vars for reusable workflow"

  bin-image:
    if: ${{ github.repository == 'docker/buildx' }}
    uses: docker/github-builder-experimental/.github/workflows/bake.yml@5876e8deef3c899c298ec80b07c43dd9e89d37f6
    needs:
      - bin-image-prepare
      - test-integration
      - test-unit
    permissions:
      contents: read # same as global permission
      id-token: write # for signing attestation(s) with GitHub OIDC Token
    with:
      runner: amd64
      target: image-cross
      cache: true
      cache-scope: bin-image
      output: image
      push: ${{ github.event_name != 'pull_request' }}
      sbom: true
      set-meta-labels: true
      meta-images: |
        ${{ needs.bin-image-prepare.outputs.repo-slug }}
      meta-tags: |
        type=ref,event=branch
        type=ref,event=pr
        type=semver,pattern={{version}}
      meta-bake-target: meta-helper
    secrets:
      registry-auths: |
        - registry: docker.io
          username: ${{ vars.DOCKERPUBLICBOT_USERNAME }}
          password: ${{ secrets.DOCKERPUBLICBOT_WRITE_PAT }}

  scout:
    runs-on: ubuntu-24.04
    if: ${{ github.ref == 'refs/heads/master' && github.repository == 'docker/buildx' }}
    permissions:
      # same as global permission
      contents: read
      # required to write sarif report
      security-events: write
    needs:
      - bin-image
    steps:
      -
        name: Login to DockerHub
        uses: docker/login-action@v3
        with:
          username: ${{ vars.DOCKERPUBLICBOT_USERNAME }}
          password: ${{ secrets.DOCKERPUBLICBOT_WRITE_PAT }}
      -
        name: Scout
        id: scout
        uses: crazy-max/.github/.github/actions/docker-scout@ccae1c98f1237b5c19e4ef77ace44fa68b3bc7e4
        with:
          version: ${{ env.SCOUT_VERSION }}
          format: sarif
          image: registry://${{ env.REPO_SLUG }}:master
      -
        name: Upload SARIF report
        uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: ${{ steps.scout.outputs.result-file }}

  release:
    runs-on: ubuntu-24.04
    permissions:
      # required to create GitHub release
      contents: write
    needs:
      - test-integration
      - test-unit
      - binaries-finalize
    steps:
      -
        name: Download release binaries
        uses: actions/download-artifact@v7
        with:
          path: ${{ env.DESTDIR }}
          name: release
      -
        name: GitHub Release
        if: startsWith(github.ref, 'refs/tags/v')
        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b  # v2.5.0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          draft: true
          files: ${{ env.DESTDIR }}/*