action.yml

name: 'docker-build'
description: 'Build docker images'
author: 'Conventional Actions'
inputs:
  name:
    required: false
    description: 'name of container'
  dockerfile:
    required: false
    description: 'dockerfile path'
  artifact:
    required: false
    description: 'name of the artifact if different from the container name'
  platforms:
    required: false
    description: 'comma-separated list of platforms to build'
    default: 'linux/amd64,linux/arm64'
  buildkitd-flags:
    required: false
    description: 'buildkitd flags to use'
    default: '--allow-insecure-entitlement network.host'
  build-args:
    description: "list of build-time variables"
    required: false
  target:
    description: "sets the target stage to build"
    required: false
  snyk-token:
    required: false
    description: 'SNYK auth token'
    default: ''
  scan:
    required: false
    description: 'set to false to disable scan (default is true)'
    default: 'true'
  download-artifacts:
    required: false
    description: 'set to false to disable downloading artifacts'
    default: 'true'
  version-major:
    required: false
    description: 'major version number'
  version-minor:
    required: false
    description: 'minor version number'
  version-patch:
    required: false
    description: 'full path version number'
  release-branch:
    required: false
    description: 'release branch name'
    default: main
  secret-files:
    required: false
    description: 'List of secret files to expose to the build (e.g., key=filename, MY_SECRET=./secret.txt)'
runs:
  using: composite
  steps:
  - id: setup
    shell: bash
    run: |
      if [[ -z "${{ inputs.dockerfile }}" ]]; then
        echo "dockerfile=docker/${{ inputs.name }}/Dockerfile" >> "$GITHUB_OUTPUT"
      else
        echo "dockerfile=${{ inputs.dockerfile }}" >> "$GITHUB_OUTPUT"
      fi
      if [[ -z "${{ inputs.artifact }}" ]]; then
        echo "artifact=${{ inputs.name }}" >> "$GITHUB_OUTPUT"
      else
        echo "artifact=${{ inputs.artifact }}" >> "$GITHUB_OUTPUT"
      fi
  - name: Download docker artifact
    uses: actions/download-artifact@v4
    with:
      name: docker
      path: docker
  - name: Download ${{ steps.setup.outputs.artifact }} amd64 binary
    uses: actions/download-artifact@v4
    if: ${{ success() && inputs.download-artifacts == 'true' && contains(inputs.platforms, 'amd64') }}
    with:
      name: ${{ steps.setup.outputs.artifact }}_linux_amd64
      path: .build/linux-amd64
  - name: Download ${{ steps.setup.outputs.artifact }} arm64 docker
    uses: actions/download-artifact@v4
    if: ${{ success() && inputs.download-artifacts == 'true' && contains(inputs.platforms, 'arm64') }}
    with:
      name: ${{ steps.setup.outputs.artifact }}_linux_arm64
      path: .build/linux-arm64
  - name: Set up QEMU
    id: qemu
    uses: docker/setup-qemu-action@v3
    with:
      platforms: ${{ inputs.platforms }}
  - name: Set up Docker Buildx
    uses: docker/setup-buildx-action@v3
    with:
      buildkitd-flags: ${{ inputs.buildkitd-flags }}
  - name: Login to GitHub Container Registry
    uses: docker/login-action@v3
    with:
      registry: ghcr.io
      username: ${{ github.actor }}
      password: ${{ env.GITHUB_TOKEN }}
  - name: Build ${{ inputs.name }} container
    id: build
    if: ${{ success() && inputs.scan == 'true' }}
    uses: docker/build-push-action@v6
    with:
      context: .
      file: ${{ steps.setup.outputs.dockerfile }}
      push: false
      load: true
      allow: network.host
      target: ${{ inputs.target }}
      cache-from: type=gha
      cache-to: type=gha,mode=max
      build-args: ${{ inputs.build-args }}
      secret-files: ${{inputs.secret-files}}
  - name: Scan ${{ inputs.name }} container
    uses: conventional-actions/docker-scan@v1
    if: ${{ success() && inputs.scan == 'true' }}
    with:
      file: ${{ steps.setup.outputs.dockerfile }}
      image: ${{ steps.build.outputs.imageid }}
    env:
      SNYK_TOKEN: ${{ inputs.snyk-token }}
  - name: Metadata for ${{ inputs.name }}
    id: meta
    uses: docker/metadata-action@v5
    with:
      images: ghcr.io/${{ github.repository_owner }}/${{ inputs.name }}
      tags: |
        type=raw,value=latest
        type=raw,value=${{ inputs.version-major }}
        type=raw,value=${{ inputs.version-minor }}
        type=raw,value=${{ inputs.version-patch }}
  - name: Push ${{ inputs.name }} container
    if: github.ref == format('refs/heads/{0}', inputs.release-branch)
    uses: docker/build-push-action@v6
    with:
      context: .
      file: ${{ steps.setup.outputs.dockerfile }}
      push: true
      load: false
      allow: network.host
      target: ${{ inputs.target }}
      cache-from: type=gha
      cache-to: type=gha,mode=max
      build-args: ${{ inputs.build-args }}
      platforms: ${{ inputs.platforms }}
      tags: ${{ steps.meta.outputs.tags }}
      labels: ${{ steps.meta.outputs.labels }}
      secret-files: ${{inputs.secret-files}}
branding:
  icon: anchor
  color: purple