build-rust-injector.yml

name: Publish Injector Stage I

on:
  workflow_dispatch:
    inputs:
      versionTag:
        description: "Version tag"
        required: true
      branchName:
        description: "Branch to build the injector from"
        required: false
        default: "master"

jobs:
  build-injector:
    runs-on: ubuntu-latest
    steps:
      - name: "Dependency: Install cosign"
        uses: sigstore/cosign-installer@v2.8.0

      - name: "Dependency: Setup rust toolchain"
        run: |
          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --no-modify-path
          echo "$HOME/.cargo/bin" >> $GITHUB_PATH

      - name: "Checkout Repo"
        uses: actions/checkout@v3
        with:
          ref: ${{ github.event.inputs.branchName }}

      - name: "Build Rust Binary for x86_64"
        working-directory: src/injector/stage1
        run: |
          cargo build --target x86_64-unknown-linux-musl --release
          strip target/x86_64-unknown-linux-musl/release/zarf-injector

      - name: "Build Rust Binary for aarch64"
        working-directory: src/injector/stage1
        run: |
          rustup target add aarch64-unknown-linux-musl
          curl https://musl.cc/aarch64-linux-musl-cross.tgz | tar -xz
          export PATH="$PWD/aarch64-linux-musl-cross/bin:$PATH"
          cargo build --target aarch64-unknown-linux-musl --release
          aarch64-linux-musl-strip target/aarch64-unknown-linux-musl/release/zarf-injector

      - name: Login to Docker Hub
        uses: docker/login-action@v2
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: "Upload Binaries To DockerHub"
        working-directory: src/injector/stage1/target
        run: |
          cosign upload blob -f x86_64-unknown-linux-musl/release/zarf-injector defenseunicorns/zarf-injector:amd64-${{ github.event.inputs.versionTag }}
          cosign upload blob -f aarch64-unknown-linux-musl/release/zarf-injector defenseunicorns/zarf-injector:arm64-${{ github.event.inputs.versionTag }}

      - name: "Sign the binaries"
        run: |
          cosign sign --key awskms:///${{ secrets.COSIGN_AWS_KMS_KEY }} -a release-engineer=https://github.com/${{ github.actor }} -a version=${{ github.event.inputs.versionTag }} defenseunicorns/zarf-injector:amd64-${{ github.event.inputs.versionTag }}
          cosign sign --key awskms:///${{ secrets.COSIGN_AWS_KMS_KEY }} -a release-engineer=https://github.com/${{ github.actor }} -a version=${{ github.event.inputs.versionTag }} defenseunicorns/zarf-injector:arm64-${{ github.event.inputs.versionTag }}
        env:
          COSIGN_EXPERIMENTAL: 1
          AWS_REGION: ${{ secrets.COSIGN_AWS_REGION }}
          AWS_ACCESS_KEY_ID: ${{ secrets.COSIGN_AWS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.COSIGN_AWS_ACCESS_KEY }}