feat(ci): add nightly build workflow for S3 + DockerHub publishing

.github/scripts/build-images.sh

@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+make docker-build && make docker-save
+make signimage-build && make signimage-save
+make webhookimage-build && make webhookimage-save
+make workerimage-build && make workerimage-save

.github/workflows/build-images.yml

@@ -0,0 +1,35 @@
+name: Build Images
+
+on:
+  workflow_call:
+    inputs:
+      push_tag:
+        required: true
+        type: string
+        description: 'Image tag for build (e.g. v0.0.1-20260910)'
+
+jobs:
+  build:
+    name: Build container images
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Build all KMM images
+        env:
+          IMAGE_TAG: ${{ inputs.push_tag }}
+          VERSION: ${{ inputs.push_tag }}
+        run: .github/scripts/build-images.sh
+
+      - name: Upload image artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: build-images-${{ inputs.push_tag }}
+          retention-days: 1
+          path: |
+            kernel-module-management-operator.tar.gz
+            kernel-module-management-signimage.tar.gz
+            kernel-module-management-webhook-server.tar.gz
+            kernel-module-management-worker.tar.gz

.github/workflows/nightly-build.yml

@@ -0,0 +1,114 @@
+name: Nightly Build
+
+on:
+  schedule:
+    - cron: '0 13 * * *'
+  workflow_dispatch:
+
+concurrency:
+  group: kmm-nightly
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  id-token: write
+  actions: write
+
+jobs:
+
+  init:
+    name: Init
+    runs-on: ubuntu-24.04
+    outputs:
+      project_version: ${{ steps.version.outputs.project_version }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Read project version
+        id: version
+        run: |
+          VERSION=$(grep -m1 'VERSION ?=' Makefile | awk '{print $NF}')
+          echo "project_version=${VERSION}" >> "$GITHUB_OUTPUT"
+          echo "Project version: ${VERSION}"
+
+  resolve:
+    name: Resolve
+    needs: init
+    uses: ROCm/common-infra-operator/.github/workflows/nightly-resolve.yml@71da675c5fba3328eb470e13a0fc9ad1401f5456
+    with:
+      component: kmm
+      version: ${{ needs.init.outputs.project_version }}
+      s3_component_prefix: kernel-module-management
+      trigger_event: ${{ github.event_name }}
+      trigger_sha: ${{ github.sha }}
+
+  build-images:
+    name: Build Images
+    needs: resolve
+    if: needs.resolve.outputs.build_needed == 'true'
+    uses: ./.github/workflows/build-images.yml
+    with:
+      push_tag: ${{ needs.resolve.outputs.push_tag }}
+
+  publish:
+    name: Publish
+    needs: [resolve, build-images]
+    if: >-
+      always()
+      && needs.resolve.outputs.build_needed == 'true'
+      && needs.build-images.result == 'success'
+    uses: ROCm/common-infra-operator/.github/workflows/rocm-publish.yml@71da675c5fba3328eb470e13a0fc9ad1401f5456
+    with:
+      component: kmm
+      image_tag: ${{ needs.resolve.outputs.push_tag }}
+      version: ${{ needs.resolve.outputs.version }}
+      suffix: ${{ needs.resolve.outputs.suffix }}
+      s3_prefix: ${{ needs.resolve.outputs.s3_prefix }}
+      trigger_sha: ${{ github.sha }}
+      s3_bucket: ${{ vars.THEROCK_BUCKET_NAME }}
+      artifact_names: build-images-${{ needs.resolve.outputs.push_tag }}
+      s3_file_globs: "*.tar.gz"
+      docker_images: |
+        kernel-module-management-operator.tar.gz|rocm/kernel-module-management-operator:${{ needs.resolve.outputs.push_tag }}|amdpsdo/kernel-module-management-operator:${{ needs.resolve.outputs.push_tag }}|false
+        kernel-module-management-signimage.tar.gz|rocm/kernel-module-management-signimage:${{ needs.resolve.outputs.push_tag }}|amdpsdo/kernel-module-management-signimage:${{ needs.resolve.outputs.push_tag }}|false
+        kernel-module-management-webhook-server.tar.gz|rocm/kernel-module-management-webhook-server:${{ needs.resolve.outputs.push_tag }}|amdpsdo/kernel-module-management-webhook-server:${{ needs.resolve.outputs.push_tag }}|false
+        kernel-module-management-worker.tar.gz|rocm/kernel-module-management-worker:${{ needs.resolve.outputs.push_tag }}|amdpsdo/kernel-module-management-worker:${{ needs.resolve.outputs.push_tag }}|false
+    secrets:
+      ROCK_CI_S3_SECRET: ${{ secrets.ROCK_CI_S3_SECRET }}
+      DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
+      DOCKER_USERNAME: ${{ vars.DOCKER_USERNAME }}
+
+  validate:
+    name: Validate
+    needs: [resolve, publish]
+    if: always() && needs.publish.result == 'success'
+    uses: ROCm/common-infra-operator/.github/workflows/rocm-orchestrator.yml@71da675c5fba3328eb470e13a0fc9ad1401f5456
+    with:
+      component: kmm
+      scenario: nightly
+      s3_prefix: ${{ needs.resolve.outputs.s3_prefix }}
+
+  results:
+    name: Summary
+    needs: [resolve, build-images, publish, validate]
+    if: always() && needs.resolve.outputs.build_needed == 'true'
+    uses: ROCm/common-infra-operator/.github/workflows/nightly-summary.yml@71da675c5fba3328eb470e13a0fc9ad1401f5456
+    with:
+      component: kmm
+      push_tag: ${{ needs.resolve.outputs.push_tag }}
+      version: ${{ needs.resolve.outputs.version }}
+      s3_prefix: ${{ needs.resolve.outputs.s3_prefix }}
+      s3_bucket: ${{ vars.THEROCK_BUCKET_NAME }}
+      trigger_sha: ${{ github.sha }}
+      prev_nightly_sha: ${{ needs.resolve.outputs.prev_nightly_sha }}
+      commit_log: ${{ needs.resolve.outputs.commit_log }}
+      stages: |
+        Build Images|${{ needs.build-images.result }}
+        Publish|${{ needs.publish.result }}
+        Validate|${{ needs.validate.result }}
+      docker_images: |
+        amdpsdo/kernel-module-management-operator:${{ needs.resolve.outputs.push_tag }}
+        amdpsdo/kernel-module-management-signimage:${{ needs.resolve.outputs.push_tag }}
+        amdpsdo/kernel-module-management-webhook-server:${{ needs.resolve.outputs.push_tag }}
+        amdpsdo/kernel-module-management-worker:${{ needs.resolve.outputs.push_tag }}