manually-build-unbound.yaml

name: Manually Build Distroless Unbound Docker Image
   
on:   
  push:
    branches: [ main ]
    paths:
      - '!**'
      - '.github/workflows/manually-build-unbound.yaml'
 
jobs:    
  build: 
    runs-on: ubuntu-latest    
    env:
      DOCKERHUB_SLUG: "madnuttah/unbound"
      IMAGE_BUILD_DATE: "Mon Feb 26 18:51:27 UTC 2024"
      UNBOUND_DOCKER_IMAGE_VERSION: "1.19.1-5"
      UNBOUND_VERSION: "1.19.1"
      UNBOUND_SHA256: "bc1d576f3dd846a0739adc41ffaa702404c6767d2b6082deb9f2f97cbb24a3a9"
    steps:
      - uses: step-security/harden-runner@v2
        with:
          egress-policy: block
          disable-telemetry: true
          allowed-endpoints: 
            dl-cdn.alpinelinux.org:443
            github.com:443
            docker.io
            index.docker.io
            auth.docker.io:443
            registry-1.docker.io:443
            production.cloudflare.docker.com:443
            objects.githubusercontent.com:443
            www.nlnetlabs.nl:443
            www.internic.net:443
            keys.openpgp.org:443
            pipelines.actions.githubusercontent.com:443 
            actions-results-receiver-production.githubapp.com:443
    
      - name: Checkout source
        uses: actions/checkout@v4

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3
      
      - name: Set up Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@v3
     
      - name: Login to Dockerhub
        if: github.event_name != 'pull_request'
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
              
      - name: Build and push
        uses: docker/build-push-action@v5
        with:
          platforms: linux/386,linux/arm/v6,linux/arm/v7,linux/arm64,linux/amd64
          builder: ${{ steps.buildx.outputs.name }}
          build-args: |
            UNBOUND_SHA256=${{ env.UNBOUND_SHA256 }} 
            IMAGE_BUILD_DATE=${{ env.IMAGE_BUILD_DATE }} 
            UNBOUND_VERSION=${{ env.UNBOUND_VERSION }} 
            UNBOUND_DOCKER_IMAGE_VERSION=${{ env.UNBOUND_DOCKER_IMAGE_VERSION }}
          file: ./unbound/Dockerfile   
          push: ${{ github.event_name != 'pull_request' }}
          tags: |
            ${{ env.DOCKERHUB_SLUG }}:${{ env.UNBOUND_DOCKER_IMAGE_VERSION }}      
            ${{ env.DOCKERHUB_SLUG }}:latest