ci: only build GCP guest agent if necessary

Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>

.github/workflows/build-gcp-guest-agent.yml

@@ -34,7 +34,41 @@ jobs:
           echo "Semver tag of guest-agent is $semver"
           echo "latest=$semver" >> "$GITHUB_OUTPUT"
 
+      - name: Check if the tag is newer than our last build
+        id: needs-build
+        run: |
+          apiURL="https://ghcr.io/v2/edgelesssys/gcp-guest-agent"
+          tokenJSON=$(curl -fsSL  "https://ghcr.io/token?scope=repository:edgelesssys/gcp-guest-agent:pull")
+          token=$(jq -r '.token' <<< "$tokenJSON")
+          tokenHeader=(-H "Authorization: Bearer ${token}")
+
+          tags=$(curl -fsSL "${tokenHeader[@]}" "${apiURL}/tags/list")
+          semverUpstream="${{ steps.latest-release-semver.outputs.latest }}"
+
+          rebuild=false
+
+          if [[ $(jq -r '.tags | index("latest")' <<< "$tags") == 'null' ]]; then
+            rebuild=true
+          elif [[ $(jq -r '.tags | index("${{ steps.latest-release-semver.outputs.latest }}")' <<< "$tags") == 'null' ]]; then
+            rebuild=true
+          else
+            digestLatest=$(curl -fsSL "${tokenHeader[@]}" "${apiURL}/manifests/latest" | jq -r '.config.digest')
+            digestSemver=$(curl -fsSL "${tokenHeader[@]}" "${apiURL}/manifests/${semverUpstream}" | jq -r '.config.digest')
+            if [[ "$digestLatest" != "$digestSemver" ]]; then
+              rebuild=true
+            fi
+          fi
+
+          if [[ $rebuild == false ]]; then
+            echo "Latest tag $latestTag is already built, exiting"
+            echo "out=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          echo "Latest tag $latestTag is older than ${semverUpstream}, building"
+          echo "out=true" >> "$GITHUB_OUTPUT"
+
       - name: Checkout GoogleCloudPlatform/guest-agent
+        if: steps.needs-build.outputs.out == 'true'
         uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
         with:
           repository: "GoogleCloudPlatform/guest-agent"
@@ -42,6 +76,7 @@ jobs:
           path: "guest-agent"
 
       - name: Checkout Constellation
+        if: steps.needs-build.outputs.out == 'true'
         uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
         with:
           path: "constellation"
@@ -49,6 +84,7 @@ jobs:
 
       - name: Docker meta
         id: meta
+        if: steps.needs-build.outputs.out == 'true'
         uses: docker/metadata-action@507c2f2dc502c992ad446e3d7a5dfbe311567a96 # v4.3.0
         with:
           images: |
@@ -63,6 +99,7 @@ jobs:
 
       - name: Log in to the Container registry
         id: docker-login
+        if: steps.needs-build.outputs.out == 'true'
         uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # tag=v2.1.0
         with:
           registry: ${{ env.REGISTRY }}
@@ -70,10 +107,12 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Prepare hardcoded configuration file
+        if: steps.needs-build.outputs.out == 'true'
         run: |
           cp "${GITHUB_WORKSPACE}/constellation/3rdparty/gcp-guest-agent/instance_configs.cfg" "${GITHUB_WORKSPACE}/guest-agent/"
 
       - name: Build and push container image
+        if: steps.needs-build.outputs.out == 'true'
         id: build
         uses: docker/build-push-action@1104d471370f9806843c095c1db02b5a90c5f8b6 # v3.3.1
         with: