kernel.yml

name: kernel

on:
  push:
    branches: [main]
    paths:
      - "kernel/**"
      - ".github/workflows/kernel.yml"
  pull_request:
    paths:
      - "kernel/**"
      - ".github/workflows/kernel.yml"
  workflow_dispatch:

permissions:
  contents: read
  packages: write

jobs:
  build:
    strategy:
      fail-fast: false
      matrix:
        arch: [amd64, arm64]
        include:
          # amd64 and arm64 build natively on their own runners -- no
          # QEMU emulation involved for either leg.
          - arch: amd64
            runs-on: ubuntu-latest
          - arch: arm64
            runs-on: ubuntu-24.04-arm
    runs-on: ${{ matrix.runs-on }}
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Log in to GHCR
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Read package version
        id: version
        run: echo "value=$(cat kernel/VERSION)" >> "$GITHUB_OUTPUT"

      # Derived from the owning org (rather than hardcoded) so the image
      # path stays correct if the org is ever renamed. GHCR requires a
      # lowercase path; github.repository_owner preserves the org's
      # actual casing.
      - name: Set image name
        id: image
        run: |
          name="ghcr.io/${{ github.repository_owner }}/kernel"
          echo "name=$(echo "$name" | tr '[:upper:]' '[:lower:]')" >> "$GITHUB_OUTPUT"

      # Only this one explicit <version>-<arch> tag is ever pushed --
      # deliberately not using docker/metadata-action's default tags
      # (`main`, `sha-<sha>`), since those aren't arch-qualified and
      # would overwrite each other between the amd64 and arm64 jobs.
      - name: Build and push
        uses: docker/build-push-action@v7
        with:
          context: kernel
          platforms: linux/${{ matrix.arch }}
          push: ${{ github.event_name != 'pull_request' }}
          build-args: KERNEL_VERSION=${{ steps.version.outputs.value }}
          tags: ${{ steps.image.outputs.name }}:${{ steps.version.outputs.value }}-${{ matrix.arch }}