ci: Push directly from build step

Refactor the workflows so that we can use build-push-action also for
publishing. This is a precondition for switching to buildx, needed for
multi-arch images.

The trick needed for this is using an environment variable to control
whether we should push when building the master branch, initializing it
according to the tag status.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>

.github/workflows/master.yml

@@ -14,6 +14,14 @@ jobs:
         uses: actions/checkout@v2
         with:
           fetch-depth: 0
+      - name: Identify release build
+        run: |
+          # The release workflow will push :latest for tagged revisions
+          if git describe --exact-match --tags --match '*.*'; then
+              echo "PUSH_MASTER=false" >> $GITHUB_ENV
+          else
+              echo "PUSH_MASTER=true" >> $GITHUB_ENV
+          fi
       - name: Login to ghcr.io
         uses: docker/login-action@v1
         with:
@@ -23,16 +31,11 @@ jobs:
       - name: Build kas image
         uses: docker/build-push-action@v2
         with:
+          push: ${{ env.PUSH_MASTER }}
           tags: ghcr.io/siemens/kas/kas
       - name: Build kas-isar image
         uses: docker/build-push-action@v2
         with:
           file: Dockerfile.isar
+          push: ${{ env.PUSH_MASTER }}
           tags: ghcr.io/siemens/kas/kas-isar
-      - name: Push images
-        run: |
-          # The release workflow will push :latest for tagged revisions
-          if ! git describe --exact-match --tags --match '*.*'; then
-              docker push ghcr.io/siemens/kas/kas
-              docker push ghcr.io/siemens/kas/kas-isar
-          fi

.github/workflows/next.yml

@@ -57,17 +57,12 @@ jobs:
       - name: Build kas image
         uses: docker/build-push-action@v2
         with:
-          tags: |
-            ghcr.io/siemens/kas/kas
-            ghcr.io/siemens/kas/kas:next
+          push: true
+          tags: ghcr.io/siemens/kas/kas:next
       - name: Build kas-isar image
         uses: docker/build-push-action@v2
         with:
           file: Dockerfile.isar
-          tags: |
-            ghcr.io/siemens/kas/kas-isar
-            ghcr.io/siemens/kas/kas-isar:next
-      - name: Push images
-        run: |
-          docker push ghcr.io/siemens/kas/kas:next
-          docker push ghcr.io/siemens/kas/kas-isar:next
+          build-args: KAS_TAG=next
+          push: true
+          tags: ghcr.io/siemens/kas/kas-isar:next

.github/workflows/release.yml

@@ -23,6 +23,7 @@ jobs:
       - name: Build kas image
         uses: docker/build-push-action@v2
         with:
+          push: true
           tags: |
             ghcr.io/siemens/kas/kas
             ghcr.io/siemens/kas/kas:${{ env.RELEASE_VERSION }}
@@ -31,15 +32,8 @@ jobs:
         uses: docker/build-push-action@v2
         with:
           file: Dockerfile.isar
+          push: true
           tags: |
             ghcr.io/siemens/kas/kas-isar
             ghcr.io/siemens/kas/kas-isar:${{ env.RELEASE_VERSION }}
             ghcr.io/siemens/kas/kas-isar:latest-release
-      - name: Push images
-        run: |
-          docker push ghcr.io/siemens/kas/kas
-          docker push ghcr.io/siemens/kas/kas:${{ env.RELEASE_VERSION }}
-          docker push ghcr.io/siemens/kas/kas:latest-release
-          docker push ghcr.io/siemens/kas/kas-isar
-          docker push ghcr.io/siemens/kas/kas-isar:${{ env.RELEASE_VERSION }}
-          docker push ghcr.io/siemens/kas/kas-isar:latest-release

Dockerfile.isar

@@ -1,6 +1,8 @@
 # This image builds Isar jobs using the kas tool
 
-FROM ghcr.io/siemens/kas/kas:latest
+ARG KAS_TAG=latest
+
+FROM ghcr.io/siemens/kas/kas:$KAS_TAG
 
 ARG DEBIAN_FRONTEND=noninteractive