action.yml

name: 'Docker build and push'
description: 'Simple Docker build and push action'
author: hello@cloudposse.com
branding:
  icon: 'box'
  color: 'white'
inputs:
  allow:
    description: "List of extra privileged entitlement (e.g., network.host,security.insecure)"
    required: false
  network:
    description: "Set the networking mode for the RUN instructions during build"
    required: false
  buildkitd-flags:
    description: 'BuildKit daemon flags'
    default: '--allow-insecure-entitlement security.insecure --allow-insecure-entitlement network.host'
    required: false
  driver-opts:
    description: 'List of additional driver-specific options. (eg. image=moby/buildkit:master)'
    required: false
  workdir:
    description: 'Working directory'
    required: false
    default: './'
  file:
    description: 'Dockerfile name'
    required: false
    default: 'Dockerfile'
  build-args:
    description: "List of build-time variables"
    required: false
  organization:
    description: 'Organization'
    required: true
  repository:
    description: 'Repository'
    required: true
  registry:
    description: 'Docker registry'
    required: true
  target:
    description: "Sets the target stage to build"
    required: false
    default: ''
  platforms:
    description: "List of target platforms for build (e.g. linux/amd64,linux/arm64,linux/riscv64,linux/ppc64le,linux/s390x,etc)"
    required: false
    default: 'linux/amd64'
  provenance:
    description: "Generate provenance attestation for the build"
    required: false
  image_name:
    description: "Image name (excluding registry). Defaults to {{$organization/$repository}}."
    required: false
    default: ''
  login:
    description: 'Docker login'
    required: false
    default: ''
  password:
    description: 'Docker password'
    required: false
    default: ''
  cache-from:
    description: "List of external cache sources for buildx (e.g., user/app:cache, type=local,src=path/to/dir)"
    required: false
    default: type=gha
  cache-to:
    description: "List of cache export destinations for buildx (e.g., user/app:cache, type=local,dest=path/to/dir)"
    required: false
    default: type=gha,mode=max
  no-cache:
    description: "Send the --no-cache flag to the docker build process"
    required: false
    default: "false"
  ssh:
    description: "List of SSH agent socket or keys to expose to the build"
    required: false
  tags:
    description: "List of tags (supports https://github.com/docker/metadata-action#tags-input)"
    required: false
  secrets:
    description: "List of secrets to expose to the build (e.g., key=string, GIT_AUTH_TOKEN=mytoken)"
    required: false
  secret-files:
    description: "List of secret files to expose to the build (e.g., key=filename, MY_SECRET=./secret.txt)"
    required: false
  docker-metadata-pr-head-sha:
    description: "Set to `true` to tag images with the PR HEAD SHA instead of the merge commit SHA within pull requests."
    required: false
    default: "false"
  debug:
    description: "Enable debug mode"
    required: false
    default: "false"
outputs:
  image:
    description: "Docker image name"
    value: ${{ inputs.registry }}/${{ steps.image_name.outputs.image_name }}
  tag:
    description: "Docker image tag"
    value: ${{ steps.tag.outputs.output }}
  metadata:
    description: "Docker image metadata"
    value: ${{ steps.get-metadata.outputs.metadata }}

runs:
  using: "composite"
  steps:
    - name: Set image name
      id: image_name
      shell: bash
      run: |
        if [ "${{ inputs.image_name }}" = "" ]; then
          echo 'image_name=${{ inputs.organization }}/${{ inputs.repository }}' >> "$GITHUB_OUTPUT"
        else
          echo 'image_name=${{inputs.image_name}}' >> "$GITHUB_OUTPUT"
        fi
    - name: Docker meta
      id: meta
      uses: docker/metadata-action@v5
      env:
        # Annoyingly, docker computes the SHA tags independently of any checkout
        # action. This option tells this action to use the PR HEAD SHA during a
        # pull request. It will then use `github.event.pull_request.head.sha`
        # instead of the merge commit (`github.sha`). This is useful for folks
        # who want to avoid merge commits in their PRs (for hotfix workflows,
        # tag predictability, builds on merge-conflicts, etc).
        DOCKER_METADATA_PR_HEAD_SHA: ${{ inputs.docker-metadata-pr-head-sha }}
      with:
        # list of Docker images to use as base name for tags
        images: |
          ${{ inputs.registry }}/${{ steps.image_name.outputs.image_name }}
        # generate Docker tags based on the following events/attributes
        # we set sha as higher priority than the defaults, so that it is the first tag
        tags: |
          type=sha
          type=schedule
          type=ref,event=branch
          type=ref,event=pr
          type=semver,pattern={{version}}
          type=semver,pattern={{major}}.{{minor}}
          type=semver,pattern={{major}}
          type=raw,value=latest,enable={{is_default_branch}}
          type=sha,format=long,priority=1001
          ${{ inputs.tags }}
        labels: |
          org.opencontainers.image.source=https://github.com/${{ inputs.organization }}/${{ inputs.repository }}

    - name: 'Install jq 1.6'
      uses: dcarbone/install-jq-action@v2.1.0
      with:
        version: 1.6
        force: 'true'

    # here we set the first tag in the output as the output of this step
    # this order is determined by the priority, we set the sha as 1001, as that is 1 above the defaults
    # If a custom tag is added we can add a priority higher than that to set that as the output.
    # https://github.com/docker/metadata-action#priority-attribute
    # this formula is, of the tags, grab the first (highest priority), then split by : for the tag, grab the tag (last element)
    - uses: cloudposse/github-action-jq@0.4.0
      id: tag
      with:
        compact: true
        raw-output: true
        input: ${{ steps.meta.outputs.json }}
        script: '.tags | ( first / ":") | .[length -1]'

    # docker context must be created prior to setting up Docker Buildx
    # https://github.com/actions-runner-controller/actions-runner-controller/issues/893
    - name: Set up Docker Context for Buildx
      shell: bash
      id: buildx-context
      run: |
        docker context create buildx-context || true

    - name: Set up QEMU
      uses: docker/setup-qemu-action@v3

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3
      with:
        endpoint: buildx-context
        buildkitd-flags: "${{ inputs.debug == 'true' && '--debug' || '' }} ${{ inputs.buildkitd-flags }}" 
        driver-opts: ${{ inputs.driver-opts }}
    - name: Login
      uses: docker/login-action@v3
      if: ${{ contains(inputs.registry, '.amazonaws.com') || ( inputs.login != '' && inputs.password != '' ) }}
      with:
        registry: ${{ inputs.registry }}
        username: ${{ inputs.login }}
        password: ${{ inputs.password }}

    - name: Build and push Docker images
      uses: docker/build-push-action@v5
      id: docker-build-push-action
      with:
        allow: ${{ inputs.allow }}
        network: ${{ inputs.network }}
        context: ${{ inputs.workdir }}
        file: ${{ inputs.workdir }}/${{ inputs.file }}
        pull: true
        push: true
        ssh: ${{ inputs.ssh }}
        build-args: ${{ inputs.build-args }}
        cache-from: ${{ inputs.cache-from }}
        cache-to: ${{ inputs.cache-to }}
        no-cache: ${{ inputs.no-cache }}
        tags: ${{ steps.meta.outputs.tags }}
        target: ${{ inputs.target }}
        labels: ${{ steps.meta.outputs.labels }}
        platforms: ${{ inputs.platforms }}
        provenance: ${{ inputs.provenance }}
        secrets: ${{ inputs.secrets }}
        secret-files: ${{ inputs.secret-files }}

    - name: Get Metadata
      id: get-metadata
      shell: bash
      run: |
        metadata=$(echo '${{ steps.docker-build-push-action.outputs.metadata }}' | jq -c)
        echo "metadata=$metadata" >> $GITHUB_OUTPUT
        echo "Docker image metadata: $metadata"