action.yaml

name: 'Build and push to a private ECR'
description: 'Build and push a Docker image to a private ERC, written for CA repositories.'
inputs:
  role_arn:
    description: 'A role to assume with permission to push to the Private ECR repository'
    required: false
    default: 'arn:aws:iam::979633842206:role/PrivateECRPush'
  dockerfile_context:
    description: 'The context of the Dockerfile. Defaults to root of project.'
    required: false
    default: '.'
  dockerfile:
    description: 'The name of the dockerfile to build. Defaults to Dockerfile'
    required: false
    default: 'Dockerfile'
  build-args:
    description: 'List of build-time variables'
    required: false
  repository_name:
    description: 'The name of the ECR repository. Will be used as the name of the Docker image'
    required: true
  auth_token:
    description: 'A token to pull the repository. Usually GITHUB_TOKEN'
    required: true
  multiarch_build:
    description: 'Build a `linux/arm64` image as well as `linux/amd64`. Defaults to disabled'
    required: false
    default: 'disabled'
  push_after_build:
    description: 'Push the image after building it. Useful if you need to run tests on the image before you push it. Defaults to `true`'
    required: false
    default: true
  prod_image:
    description: 'Tag the image as a production image. Adds `latest tag` on push. Defaults to false'
    required: false
    default: 'false'
  tags_override:
    description: 'Override the default tags. This will replace ALL of the default tags'
    required: false
    default: ''

outputs:
  image_id:
    description: 'ID of the image'
    value: ${{ steps.build_and_push.outputs.imageid }}
  image_digest:
    description: 'Digest of the image'
    value: ${{ steps.build_and_push.digest }}
  image_tags:
    description: 'A CSV list of the image tags'
    value: ${{ steps.configure-tags.outputs.tags }}

runs:
  using: 'composite'
  steps:
    - uses: runs-on/action@46910bf61b41721b0579f237e186afb35477007a
    
    - name: Configure Multi-arch Build
      id: multiarch
      shell: bash
      run: |
        if [[ "${{ inputs.multiarch_build }}" == "enabled" ]] ; then
          echo "multiarch=local,linux/arm64" | tee -a $GITHUB_OUTPUT
        elif [[ "${{ inputs.multiarch_build }}" == "disabled" ]] ; then
          echo "multiarch=local" | tee -a $GITHUB_OUTPUT
        else
          echo "Input `multiarch_build` not set correctly. Options are 'enabled' or 'disabled'"
          exit 1
        fi

    - name: Configure AWS Credentials
      uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c
      with:
        role-to-assume: ${{ inputs.role_arn }}
        role-session-name: ${{ inputs.repository_name }}-actions-workflow
        aws-region: eu-west-1

    - name: ECR login
      id: ecr-login
      uses: aws-actions/amazon-ecr-login@03f1aad4c6c7ffd436567f42f9384779290529bd
      with:
        registry-type: private

    - name: Get branch name
      id: branch-name
      shell: bash
      run: |
        branch=${{ github.head_ref || github.ref_name }}
        echo "name=${branch//\//-}" | tee -a $GITHUB_OUTPUT

    - name: Configure latest tag
      id: latest-tag
      shell: bash
      run: |
        if [[ "${{ inputs.prod_image }}" == "true" ]] ; then
          echo "tag=${{ steps.ecr-login.outputs.registry }}/${{ inputs.repository_name }}:latest" | tee -a $GITHUB_OUTPUT
        elif [[ "${{ inputs.prod_image }}" == "false" ]] ; then
          echo "tag=" | tee -a $GITHUB_OUTPUT
        else
          echo "Input `prod_image` not set correctly. Options are 'true' or 'false'"
          exit 1
        fi

    - name: Configure dev tag
      id: dev-tag
      shell: bash
      run: |
        if [[ "${{ inputs.prod_image }}" == "false" ]] ; then
          echo "tag=dev_" | tee -a $GITHUB_OUTPUT
        elif [[ "${{ inputs.prod_image }}" == "true" ]] ; then
          echo "tag=" | tee -a $GITHUB_OUTPUT
        else
          echo "Input `dev_tag` not set correctly. Options are 'true' or 'false'"
          exit 1
        fi

    - name: Configure tags
      id: configure-tags
      shell: bash
      run: |
        if [[ "${{ inputs.tags_override }}" == "" ]] ; then
          echo  "tags=${{ steps.ecr-login.outputs.registry }}/${{ inputs.repository_name }}:${{ steps.dev-tag.outputs.tag }}${{ github.sha }},${{ steps.ecr-login.outputs.registry }}/${{ inputs.repository_name }}:${{ steps.branch-name.outputs.name }},${{ steps.latest-tag.outputs.tag }}" | tee -a $GITHUB_OUTPUT
        else
          python -c 'print("tags=" + ",".join(f"${{ steps.ecr-login.outputs.registry }}/${{ inputs.repository_name }}:{tag}" for tag in "${{ inputs.tags_override }}".split(",")))' | tee -a $GITHUB_OUTPUT
        fi

    - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8
      if: ${{ inputs.multiarch_build == 'enabled' }}

    - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e
      with:
        platforms: ${{ steps.multiarch.outputs.multiarch }}
        driver-opts: |
          image=979633842206.dkr.ecr.eu-west-1.amazonaws.com/docker-hub/moby/buildkit:master

    - name: Build and push Docker image
      uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a
      id: build_and_push
      with:
        context: ${{ inputs.dockerfile_context }}
        file: ${{ inputs.dockerfile }}
        push: ${{ inputs.push_after_build }}
        build-args: ${{ inputs.build-args }}
        load: false
        platforms: ${{ steps.multiarch.outputs.multiarch }}
        tags: ${{ steps.configure-tags.outputs.tags }}