From 5a20fc903786a8149dc3f3504c32434131e5a8c4 Mon Sep 17 00:00:00 2001
From: Anurag Mittal <1321012+anurag4DSB@users.noreply.github.com>
Date: Thu, 22 Oct 2026 15:56:03 +0200
Subject: [PATCH] CLDSRV-1048: Build the scality-kms image on epic CI

Federation pins scality-kms at the CloudServer version. Today only an
official CloudServer release builds that image, through the scality-kms
release workflow. BNaaS D1 epic tags skip the official release and
retag CI images, so each epic head needs its own scality-kms image.

A build-kms job runs after build, on epic pushes and on manual runs. It
checks out the private scality/scality-kms with the GitHub App token,
builds its Dockerfile on top of cloudserver:<sha>-federation, and pushes
ghcr.io/scality/scality-kms:<sha>-federation. A label records the
scality-kms commit it was built from. The image holds the proprietary
SafeNet library, so it goes only to the private scality-kms package,
never to the public cloudserver one. For the same reason the build log
stays quiet and the checkout keeps no token on disk.

The job exists only on the epic, and the final merge removes it.
---
 .github/workflows/tests.yaml | 62 ++++++++++++++++++++++++++++++++++++
 1 file changed, 62 insertions(+)

diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml
index 57a205233e..b34b40d0a7 100644
--- a/.github/workflows/tests.yaml
+++ b/.github/workflows/tests.yaml
@@ -308,6 +308,68 @@ jobs:
             alerts.yaml:application/prometheus-alerts+yaml
         working-directory: monitoring
 
+  build-kms:
+    # BNaaS D1 epic only. Federation pins scality-kms at the CloudServer
+    # version, and an epic tag retags CI images instead of running the
+    # release workflow, so each epic head needs its own scality-kms image.
+    # It is built on top of the federation image of the build job. The
+    # build log stays quiet: this repository is public, scality-kms is not.
+    needs: build
+    if: github.ref == 'refs/heads/epic/S3C-10971-bnaas-d1' || github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Generate GitHub App Token
+        uses: actions/create-github-app-token@v1
+        id: app-token
+        with:
+          app-id: ${{ vars.ACTIONS_APP_ID }}
+          private-key: ${{ secrets.ACTIONS_APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: scality-kms
+          permission-contents: read
+
+      - name: Checkout scality-kms
+        id: kms-checkout
+        uses: actions/checkout@v4
+        with:
+          repository: scality/scality-kms
+          ref: main
+          token: ${{ steps.app-token.outputs.token }}
+          path: scality-kms
+          persist-credentials: false
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to GitHub Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ github.token }}
+
+      - name: Build and push scality-kms image
+        uses: docker/build-push-action@v5
+        env:
+          BUILDKIT_PROGRESS: quiet
+          DOCKER_BUILD_SUMMARY: false
+          DOCKER_BUILD_RECORD_UPLOAD: false
+        with:
+          push: true
+          context: scality-kms
+          provenance: false
+          build-args: |
+            CLOUDSERVER_TAG=${{ github.sha }}-federation
+          tags: |
+            ghcr.io/${{ github.repository_owner }}/scality-kms:${{ github.sha }}-federation
+          labels: |
+            git.repository=${{ github.repository }}
+            git.commit-sha=${{ github.sha }}
+            scality-kms.commit-sha=${{ steps.kms-checkout.outputs.commit }}
+
   multiple-backend:
     runs-on: ubuntu-24.04
     needs: build