docker.yml

---
name: Docker Workflow

on:
  workflow_call:
    inputs:
      registry:
        description: "Registry to upload images to"
        default: ghcr.io
        required: false
        type: string
      registry_user:
        description: "Username for the container registry"
        default: ${{ github.repository_owner }}
        required: false
        type: string
      image_name:
        description: "Name of the image to be pushed"
        default: ${{ github.repository }}
        required: false
        type: string
      tags:
        description: "Custom tags to build"
        default: |
          type=schedule
          type=ref,event=branch
          type=ref,event=tag
          type=ref,event=pr
        required: false
        type: string
      artifact_name:
        description: "Name of the artifact to be downloaded before"
        required: false
        type: string
      artifact_path:
        description: "Directory where the artifact should be unpacked"
        required: false
        default: .
        type: string
      push:
        description: "Whether to push the image, or just build"
        required: true
        type: boolean
      build_args:
        description: "List of build arguments, as an array inside a string"
        required: false
        default: "[]"
        type: string
      file:
        description: "Path to the Dockerfile. (default `Dockerfile`)"
        required: false
        default: "Dockerfile"
        type: string
      arm_runner:
        description: "Runner size to use for arm builds. Refer to GH Actions documentation for options"
        required: false
        default: arm-ubuntu-latest-8core
        type: string
      amd64_runner:
        description: "Runner size to use for amd64 builds. Refer to GH Actions documentation for options"
        required: false
        default: ubuntu-latest
        type: string

jobs:
  docker:
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: amd64
            runner: ${{ inputs.amd64_runner }}
          - platform: arm64
            runner: ${{ inputs.arm_runner }}
    runs-on: ${{ matrix.runner }}
    permissions:
      contents: read
      packages: write

    outputs:
      tags: ${{ steps.tag.outputs.tags }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Setup Docker buildx
        uses: docker/setup-buildx-action@v3

      - name: Download artifact
        if: ${{ inputs.artifact_name != '' }}
        uses: actions/download-artifact@v4
        with:
          name: ${{inputs.artifact_name}}
          path: ${{inputs.artifact_path}}

      - name: Log into registry ${{ inputs.registry }}
        if: inputs.push
        uses: docker/login-action@v3
        with:
          registry: ${{ inputs.registry }}
          username: ${{ inputs.registry_user }}
          password: ${{ secrets.registry_password || secrets.GITHUB_TOKEN }}

      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ inputs.registry }}/${{ inputs.image_name }}
          tags: ${{ inputs.tags }}

      - name: Build and push Docker image
        id: build
        uses: docker/build-push-action@v5
        with:
          context: .
          push: ${{ inputs.push }}
          labels: ${{ steps.meta.outputs.labels }}
          platforms: linux/${{ matrix.platform }}
          build-args: ${{ inputs.build_args }}
          file: ${{ inputs.file }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          sbom: true
          outputs: type=image,name=${{ inputs.registry }}/${{ inputs.image_name }},push-by-digest=${{ inputs.push }},name-canonical=true,push=${{ inputs.push }}

      - name: Get actual tag
        id: tag
        run: |
          echo "tags=$(echo '${{ toJSON(fromJSON(steps.meta.outputs.json).tags) }}' | jq 'if (type) == "array" then .[0] else . end' | sed 's/\"//g' | cut -d ':' -f 2)" >> $GITHUB_OUTPUT

      - name: Create cleaned up registry variable
        id: clean_registry
        run: |
          echo "clean_registry=$(echo '${{ inputs.registry }}' | sed 's/\//-/g')" >> $GITHUB_OUTPUT

      - name: Export digest
        run: |
          mkdir -p /tmp/digests
          digest="${{ steps.build.outputs.digest }}"
          touch "/tmp/digests/${digest#sha256:}"

      - name: Upload digest
        uses: actions/upload-artifact@v4
        with:
          name: digests-${{ steps.clean_registry.outputs.clean_registry }}-${{ inputs.image_name }}-${{ steps.tag.outputs.tags }}-${{ matrix.platform }}
          path: /tmp/digests/*
          if-no-files-found: error
          retention-days: 1

  merge:
    runs-on: ubuntu-latest
    if: inputs.push
    needs:
      - docker

    steps:
      - name: Create cleaned up registry variable
        id: clean_registry
        run: |
          echo "clean_registry=$(echo '${{ inputs.registry }}' | sed 's/\//-/g')" >> $GITHUB_OUTPUT

      - name: Download digests
        uses: actions/download-artifact@v4
        with:
          path: /tmp/digests
          pattern: digests-${{ steps.clean_registry.outputs.clean_registry }}-${{ inputs.image_name }}-${{ needs.docker.outputs.tags }}-*
          merge-multiple: true

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ inputs.registry }}/${{ inputs.image_name }}
          tags: ${{ inputs.tags }}

      - name: Log into registry ${{ inputs.registry }}
        uses: docker/login-action@v3
        with:
          registry: ${{ inputs.registry }}
          username: ${{ inputs.registry_user }}
          password: ${{ secrets.registry_password || secrets.GITHUB_TOKEN }}

      - name: Create manifest list and push
        working-directory: /tmp/digests
        run: |
          docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
            $(printf '${{ inputs.registry }}/${{ inputs.image_name }}@sha256:%s ' *)

      - name: Inspect image
        run: |
          docker buildx imagetools inspect ${{ inputs.registry }}/${{ inputs.image_name }}:${{ steps.meta.outputs.version }}

      - name: Inspect sbom
        run: |
          docker buildx imagetools inspect ${{ inputs.registry }}/${{ inputs.image_name }}:${{ steps.meta.outputs.version }} --format '{{ json .SBOM }}' | jq