build-image.yml

name: Build Image On Release

on:
  workflow_call:
    inputs:
      target-arch:
        required: true
        type: string
      repo_owner:
        required: true
        type: string
      app_name:
        required: true
        type: string
      release_type:
        required: true
        type: string
      release_url:
        required: false
        type: string
      release_name:
        required: false
        type: string
    secrets:
      OP_SERVICE_ACCOUNT_TOKEN:
        required: true

jobs:
  bake:
    runs-on: ubuntu-22.04
    if: ${{ github.actor != 'dependabot[bot]' }}
    steps:
      -
        name: Checkout
        uses: actions/checkout@v4
      -
        name: Docker meta
        id: docker_meta
        uses: docker/metadata-action@v5.6.1
        with:
          images: |
            ghcr.io/${{ inputs.repo_owner }}/${{ inputs.app_name }}
          labels: |
            org.opencontainers.image.title=${{ inputs.app_name }}
            org.opencontainers.image.description=${{ inputs.app_name }}
            org.opencontainers.image.vendor=${{ inputs.repo_owner }}
          tags: |
            type=schedule
            type=ref,event=branch
            type=ref,event=tag
            type=ref,event=pr
            type=raw,value=latest,enable={{is_default_branch}}
      -
        name: Set up QEMU
        uses: docker/setup-qemu-action@v3
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3.9.0
      -
        name: Install Cosign
        uses: sigstore/cosign-installer@v3.8.1
      -
        name: Login to GitHub Container Registry
        uses: docker/login-action@v3.3.0
        with:
          registry: ghcr.io
          username: ${{ inputs.repo_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      -
        name: Generate build date
        id: gen_date
        run: |
          BUILD_DATE=$(date '+%Y-%m-%dT%H:%M:%S%:z')
          echo "**** Setting build date to $BUILD_DATE ****"
          echo "build_date=${BUILD_DATE}" >> $GITHUB_OUTPUT
      -
        name: Generate release version
        id: gen_release
        run: |
          if [ -z ${{ github.event.release.tag_name }} ]; then
          IMAGE_VERSION=$(curl -s "https://api.github.com/repos/${{ inputs.repo_owner }}/docker-${{ inputs.app_name }}/releases" | jq -r '(sort_by(.published_at) | .[-1].tag_name)?')
            if [ -z $IMAGE_VERSION ] || [ $IMAGE_VERSION == null ]; then
              case ${{ inputs.release_type }} in
                github)
                  IMAGE_VERSION=$(curl -sX GET "${{ inputs.release_url }}/releases/latest" | awk '/tag_name/{print $4;exit}' FS='[""]');
                  ;;
                github_tag)
                  IMAGE_VERSION=$(curl -sX GET "${{ inputs.release_url }}/tags" | jq -r 'first(.[] | select(.name | contains("${{ inputs.release_name }}") )) | .name');
                  ;;
                github_commit)
                  IMAGE_VERSION=$(curl -sL "${{ inputs.release_url }}" | jq -r 'first(.[])' | cut -c1-8);
                  ;;
                alpine)
                  IMAGE_VERSION=$(curl -sL "http://dl-cdn.alpinelinux.org/alpine/${{ inputs.release_url }}/x86_64/APKINDEX.tar.gz" | tar -xz -C /tmp && awk '/^P:'"${{ inputs.release_name }}"'$/,/V:/' /tmp/APKINDEX | sed -n 2p | sed 's/^V://');
                  ;;
                script)
                  if test -f "./get-version.sh"; then
                    IMAGE_VERSION=$(bash "./get-version.sh");
                  fi
                  ;;
              esac
            fi
          else
            IMAGE_VERSION=${{ github.event.release.tag_name }}
          fi
          APP_VERSION=$(echo ${IMAGE_VERSION} | awk -F'-ls' '{print $1}')
          echo "**** Setting release tag to $IMAGE_VERSION ****"
          echo "tag_name=${IMAGE_VERSION}" >> $GITHUB_OUTPUT
          echo "app_version=${APP_VERSION}" >> $GITHUB_OUTPUT
      -
        name: Build and push
        id: build_push
        uses: docker/bake-action@v6.5.0
        with:
          files: |
            ./docker-bake.hcl
            ${{ steps.docker_meta.outputs.bake-file }}
          set: |
            image.args.BUILD_DATE=${{ steps.gen_date.outputs.build_date }}
            image.args.VERSION=${{ steps.gen_release.outputs.tag_name }}
            image.args.APP_VERSION=${{ steps.gen_release.outputs.app_version }}
          targets: ${{ inputs.target-arch }}
          push: true
          provenance: false
          sbom: true
      -
        name: Get Digest
        id: get_digest
        env:
          BAKE_METADATA: ${{ steps.build_push.outputs.metadata }}
        run: |
          DIGEST=$(jq -rc '.[]."containerimage.digest"' <<< "${BAKE_METADATA}")
          echo "Image digest: ${DIGEST}"
          echo "image_digest=${DIGEST}" >> $GITHUB_OUTPUT
      -
        name: Load Key
        id: op-load-key
        uses: 1password/load-secrets-action@v2
        with:
          export-env: true
        env:
          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
          COSIGN_PRIVATE_KEY: op://Labs/labs-sigstore-key/notesPlain
          COSIGN_PASSWORD: op://Labs/labs-sigstore-pass/password
      -
        name: Sign image with a key
        run: |
          images=""
          for tag in ${TAGS}; do
            images+="${tag}@${DIGEST} "
          done
          cosign sign --yes --key env://COSIGN_PRIVATE_KEY ${images}
        env:
          TAGS: ${{ steps.docker_meta.outputs.tags }}
          DIGEST: ${{ steps.get_digest.outputs.image_digest }}