reusable-docker-build.yml

name: Reusable Docker build
env:
  VERSION_CRANE: v0.16.1
on:
  workflow_call:
    inputs:
      context:
        required: true
        type: string
        default: .
        description: |
          path to image source.
      imageName:
        required: true
        type: string
        description: |
          the short name for image builds.
          e.g: nginx
      dockerfile:
        required: true
        type: string
        default: ./Dockerfile
        description: |
          path to the image dockerfile.
      registryOverride:
        required: false
        type: string
        description: |
          a container registry to use instead of ghcr.io.
          e.g:
            - quay.io
            - registry.gitlab.com/somecoolproject
            - ghcr.io/somecoolproject/thing
      registryGhcrUsernameOverride:
        required: false
        type: string
        description: |
          a container registry to use instead of ghcr.io.
      tags:
        required: false
        type: string
        default: latest,git-${{ github.sha }}
        description: |
          a comma separated list of tags to image tags.
          e.g:
            - latest,20230607,git-deadb33f
            - cooltag,v2.0.2
            - latest
      deploymentTagOverride:
        required: false
        type: string
        description: |
          overrides the default deployment tag.
      buildArgs:
        required: false
        type: string
        description: |
          a multi-line separated list of build args.
          e.g: |
              THING1=a
              THING2=b
      platforms:
        required: false
        type: string
        default: "linux/amd64"
        description: |
          comma-separated list of the target platforms for container builds.
          e.g:
            - all
            - linux/amd64
            - linux/arm64,linux/amd64
      push:
        required: false
        type: boolean
        default: false
        description: |
          set to true to push an image to a registry. When set to false, it will build and exit
      aws-region:
        type: string
        default: ap-southeast-2
        required: false
        description: |
          the AWS region to use; e.g ap-southeast-2
      aws-role-arn-to-assume:
        type: string
        required: false
        description: |
          an AWS role ARN to assume.
          e.g: arn:aws:iam::ACCOUNT_ID:role/github-actions-ROLE_NAME
      aws-role-duration-seconds:
        type: string
        default: "3600"
        required: false
        description: |
          the amount of seconds to hold a session open for.
      aws-role-session-name:
        type: string
        required: false
        description: |
          the name of the session to use for AssumeRole(WithWebIdentity).
      runs-on:
        type: string
        description: |
          machine type to run on
        required: false
        default: ubuntu-latest
      timeout-mins:
        type: number
        description: "minutes before build will timeout"
        required: false
        default: 30
      artifact-name:
        type: string
        required: false
        description: |
          the name of the GitHub Actions artifact to download
      artifact-path:
        type: string
        required: false
        description: |
          the path in the GitHub Actions artifact to download
      target:
        type: string
        required: false
        description: |
          the name of the target stage to build
      setup:
        type: string
        required: false
        description: |
          shell commands to setup the build environment
      test:
        type: string
        required: false
        description: |
          shell commands to test the built image.
          use the special variables '$IMAGE' and '$PUSH' to use the locally built CI image for testing
    secrets:
      GH_CI_USER_TOKEN:
        required: false
    outputs:
      image:
        value: ${{ jobs.build.outputs.image }}
        description: |
          image uri based on deployment tag

jobs:
  build:
    runs-on: ${{ inputs.runs-on }}
    timeout-minutes: ${{ inputs.timeout-mins }}
    outputs:
      image: ${{ steps.image.outputs.image }}
    steps:
      - if: ${{ startsWith(github.repository, 'GeoNet/') == false }}
        name: require GeoNet org
        run: |
          exit 1
      - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
        with:
          go-version: stable
          check-latest: true
      - uses: GeoNet/setup-crane@00c9e93efa4e1138c9a7a5c594acd6c75a2fbf0c # main
        with:
          version: ${{ env.VERSION_CRANE }}
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - id: default-deployment-tag
        uses: GeoNet/Actions/.github/actions/tagging@main
      - name: Generate deployment tag # TODO can this be combined with default-deployment-tag step?
        id: deployment-tag
        run: |
          echo "tag=${{ inputs.deploymentTagOverride == '' && steps.default-deployment-tag.outputs.tag || inputs.deploymentTagOverride }}" >> $GITHUB_OUTPUT
      - name: Set up QEMU
        uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3.0.0
        with:
          image: ghcr.io/geonet/base-images/binfmt:latest
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
      - name: setup
        run: |
          eval '${{ inputs.setup }}'
      - name: validate
        env:
          CONTEXT: ${{ inputs.context }}
          IMAGE_NAME: ${{ inputs.imageName }}
          DOCKERFILE: ${{ inputs.dockerfile }}
          REGISTRY_OVERRIDE: ${{ inputs.registryOverride }}
          REGISTRY_GHCR_USERNAME_OVERRIDE: ${{ inputs.registryGhcrUsernameOverride }}
          TAGS: ${{ format('{0},{1}', inputs.tags, steps.deployment-tag.outputs.tag) }}
          BUILD_ARGS: ${{ inputs.buildArgs }}
          PLATFORMS: ${{ inputs.platforms }}
          PUSH: ${{ inputs.push }}
          AWS_REGION: ${{ inputs.aws-region }}
          AWS_ROLE_ARN_TO_ASSUME: ${{ inputs.aws-role-arn-to-assume }}
          AWS_ROLE_DURATION_SECONDS: ${{ inputs.aws-role-duration-seconds }}
          AWS_ROLE_SESSION_NAME: ${{ inputs.aws-role-session-name }}
          TIMEOUT_MINS: ${{ inputs.timeout-mins }}
          ARTIFACT_NAME: ${{ inputs.artifact-name }}
          ARTIFACT_PATH: ${{ inputs.artifact-path }}
          SETUP: ${{ inputs.setup }}
          TEST: ${{ inputs.test }}
        run: |
          FAIL=false
          if [ ! -d "$CONTEXT" ]; then
            echo "error: context input path '$CONTEXT' not found" >/dev/stderr
            FAIL=true
          fi
          # TODO IMAGE_NAME regexp validate
          if [ ! -f "$DOCKERFILE" ]; then
            echo "error: dockerfile input path '$DOCKERFILE' not found" >/dev/stderr
            FAIL=true
          fi
          # TODO REGISTRY_OVERRIDE regexp validate
          # TODO TAGS regexp validate
          # TODO PLATFORMS regexp validate
          case "$PUSH" in
            true|false)

            ;;
            *)
              echo "error: push input must be true or false" >/dev/stderr
              FAIL=true
          esac
          if [ -z "$REGISTRY_OVERRIDE" ] && \
            ! ( [ -z "$AWS_REGION" ] || [ -z "$AWS_ROLE_ARN_TO_ASSUME" ] || [ -z "$AWS_ROLE_DURATION_SECONDS" ] ); then
            echo "error: registryOverride input must be set when using aws-region, aws-role-arn-to-assume and aws-role-duration-seconds" >/dev/stderr
            FAIL=true
          fi
          if [ -z "$TIMEOUT_MINS" ] && ! [[ "$TIMEOUT_MINS" =~ '^[0-9]+$' ]]; then
            echo "error: timeout-mins input must be a number" >/dev/stderr
            FAIL=true
          fi
          if ( [ ! -z "$ARTIFACT_NAME" ] && [ -z "$ARTIFACT_PATH" ] ) || \
            ( [ -z "$ARTIFACT_NAME" ] && [ ! -z "$ARTIFACT_PATH" ] ); then
            echo "error: artifact-name and artifact-path inputs must be set together" >/dev/stderr
            FAIL=true
          fi

          if [ "$FAIL" = true ]; then
            exit 1
          fi
      - id: run-info
        name: collect job run info
        env:
          REGISTRY_OVERRIDE: ${{ inputs.registryOverride }}
          GHCR_DOCKER_REPO: ghcr.io/${{ github.repository }}
          IMAGE_NAME: ${{ inputs.imageName }}
          TAGS: ${{ format('{0},{1}', inputs.tags, steps.deployment-tag.outputs.tag) }}
          PLATFORMS: ${{ inputs.platforms }}
          PUSH: ${{ inputs.push }}
        run: |
          TAGS="${TAGS:-latest}"
          REGISTRY="${GHCR_DOCKER_REPO,,}"
          [ -z "$REGISTRY_OVERRIDE" ] || REGISTRY="$REGISTRY_OVERRIDE"
          IMAGE_WITH_TAG_FOR_TEST=""
          IMAGES_WITH_TAGS=""
          for TAG in $(echo $TAGS | tr ',' ' '); do
            NEW_TAG="$REGISTRY/$IMAGE_NAME:$TAG"
            if [ -n "$IMAGES_WITH_TAGS" ]; then
              IMAGES_WITH_TAGS="$NEW_TAG,$IMAGES_WITH_TAGS"
            else
              IMAGES_WITH_TAGS="$NEW_TAG"
            fi
            if [ -z "$IMAGE_WITH_TAG_FOR_TEST" ]; then
              IMAGE_WITH_TAG_FOR_TEST="$NEW_TAG"
            fi
          done
          # NOTE docker buildx --load doesn't support multiple architectures
          #      just use linux/amd64 when using test
          if [ "$PUSH" = "false" ]; then
            PLATFORMS=linux/amd64
          fi
          echo "platforms=$PLATFORMS" >> $GITHUB_OUTPUT
          echo "image=$REGISTRY/$IMAGE_NAME" >> $GITHUB_OUTPUT
          echo "images-with-tags=$IMAGES_WITH_TAGS" >> $GITHUB_OUTPUT
          echo "image-with-tag-for-test=$IMAGE_WITH_TAG_FOR_TEST" >> $GITHUB_OUTPUT
      - name: get session name
        id: get-session-name
        if: ${{ inputs.aws-region != '' && inputs.aws-role-arn-to-assume != '' && inputs.aws-role-duration-seconds != '' && inputs.registryOverride != '' }}
        env:
          REPO: ${{ github.repository }}
          AWS_ROLE_SESSION_NAME: ${{ inputs.aws-role-session-name }}
        run: |
          SESSION_NAME="$(echo "github-actions-$REPO" | sed 's,/,--,g' | tr '[[:upper:]]' '[[:lower:]]')"
          if [ -n "$AWS_ROLE_SESSION_NAME" ]; then
            SESSION_NAME="$AWS_ROLE_SESSION_NAME"
          fi
          echo "session-name=$SESSION_NAME" >> $GITHUB_OUTPUT
      - name: Login to ghcr.io
        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Configure AWS Credentials
        if: ${{ inputs.push == true && inputs.aws-region != '' && inputs.aws-role-arn-to-assume != '' && inputs.aws-role-duration-seconds != '' && steps.get-session-name.outputs.session-name != '' && inputs.registryOverride != '' }}
        uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
        with:
          aws-region: ${{ inputs.aws-region }}
          role-to-assume: ${{ inputs.aws-role-arn-to-assume }}
          role-duration-seconds: ${{ inputs.aws-role-duration-seconds }}
          role-session-name: ${{ steps.get-session-name.outputs.session-name }}
      - name: login to ECR
        if: ${{ inputs.push == true && inputs.aws-region != '' && inputs.aws-role-arn-to-assume != '' && inputs.aws-role-duration-seconds != '' && steps.get-session-name.outputs.session-name != '' }}
        run: |
          aws ecr get-login-password --region ${{ inputs.aws-region }} | crane auth login ${{ inputs.registryOverride }} -u AWS --password-stdin
      - name: override login to ghcr
        if: ${{ env.registryGhcrUsernameOverride != '' && env.registryGhcrPasswordOverride != '' }}
        env:
          registryGhcrUsernameOverride: ${{ inputs.registryGhcrUsernameOverride }}
          registryGhcrPasswordOverride: ${{ secrets.GH_CI_USER_TOKEN }}
        run: |
          echo "${{ env.registryGhcrPasswordOverride }}" | crane auth login ghcr.io -u ${{ env.registryGhcrUsernameOverride }} --password-stdin
      - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
        if: ${{ inputs.artifact-name != '' && inputs.artifact-path != '' }}
        with:
          name: ${{ inputs.artifact-name }}
          path: ${{ inputs.artifact-path }}
      - name: Build
        uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0
        id: build
        with:
          push: false
          load: true
          tags: ${{ steps.run-info.outputs.images-with-tags }}
          context: ${{ inputs.context }}
          platforms: ${{ steps.run-info.outputs.platforms }}
          file: ${{ inputs.dockerfile }}
          build-args: ${{ inputs.buildArgs }}
          labels: |
            org.opencontainers.image.name=${{ inputs.imageName }}
            org.opencontainers.image.revision=${{ github.sha }}
            org.opencontainers.image.source=${{ github.repositoryUrl }}
          target: ${{ inputs.target }}
      - name: test
        if: ${{ inputs.test != '' }}
        env:
          IMAGE: ${{ steps.run-info.outputs.image-with-tag-for-test }}
          PUSH: ${{ inputs.push }}
        run: |
          eval '${{ inputs.test }}'
      - name: Push
        if: ${{ inputs.push == true }}
        uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0
        id: push
        with:
          push: ${{ inputs.push }}
          tags: ${{ steps.run-info.outputs.images-with-tags }}
          context: ${{ inputs.context }}
          platforms: ${{ inputs.platforms }}
          file: ${{ inputs.dockerfile }}
          build-args: ${{ inputs.buildArgs }}
          labels: |
            org.opencontainers.image.name=${{ inputs.imageName }}
            org.opencontainers.image.revision=${{ github.sha }}
            org.opencontainers.image.source=${{ github.repositoryUrl }}
          target: ${{ inputs.target }}
      - name: get-digests
        id: get-digests
        if: ${{ inputs.push == true }}
        env:
          DESTINATION: ${{ steps.run-info.outputs.image }}@${{ steps.push.outputs.digest }}
        run: |
          DESTINATION_DIGEST="$(crane digest "${DESTINATION}" || true)"
          (
            echo "DESTINATION_DIGEST"
            echo "${DESTINATION_DIGEST}"
          ) | column -t
          echo "destination=${DESTINATION_DIGEST}" >> $GITHUB_OUTPUT
      - name: Generate image URI
        id: image
        env:
          IMAGE_URI: ${{ steps.run-info.outputs.image }}:${{ steps.deployment-tag.outputs.tag }}
        run: |
          echo "image=$IMAGE_URI" >> $GITHUB_OUTPUT
          echo $IMAGE_URI > imageinfo_${{ inputs.imageName}}${{ github.run_id }}${{ github.run_attempt }}.txt
      - name: Upload imageinfo
        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
        with:
          name: ${{ inputs.imageName }}${{ github.run_id }}${{ github.run_attempt }}
          path: imageinfo_${{ inputs.imageName }}${{ github.run_id }}${{ github.run_attempt }}.txt
          if-no-files-found: error
          retention-days: 1
      - name: image result
        if: ${{ inputs.push == true }}
        id: result
        env:
          IMAGE: ${{ steps.image.outputs.image }}
        run: |
          echo -e "Built and pushed:\n\n$(echo "$IMAGE" | sed 's/,/\n/g' | sed 's/^/- /g')"