reusable-build-and-push.yml

name: "[reusable only] Build images and push to registry"

on:
  workflow_dispatch:
  workflow_call:
    inputs:
      tag:
        required: false
        type: string
      sha:
        required: false
        type: string
        default: ${{ github.sha }}
    secrets:
      DOCKER_HUB_USERNAME:
        required: true
      DOCKER_HUB_PASSWORD:
        required: true
      SENTRY_AUTH_TOKEN:

env:
  DOCKER_BUILDKIT: 1
  COMPOSE_DOCKER_CLI_BUILD: 1

jobs:
  build-info:
    runs-on: ubuntu-latest
    outputs:
      repo-owner: ${{ steps.repo-owner.outputs.result }}
      tags: ${{ steps.image-tags.outputs.image-tags }}
      build-config: ${{ steps.build-info.outputs.result }}
    steps:
      #github forces lower case for the image name
      - name: Get lowercase repo owner name
        uses: actions/github-script@v8
        id: repo-owner
        with:
          result-encoding: string
          script: |
            return context.repo.owner.toLowerCase()

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          ref: ${{ inputs.sha }}

      - name: Set nightly tag if commit was on main
        id: add-nightly-tag
        if: startsWith(github.ref, 'refs/heads/devel')
        run: |
          echo "nightly-tag=nightly" | tr -d "\n"  >> $GITHUB_OUTPUT

      - name: Set latest tag if its a tag
        id: add-latest-tag
        if: startsWith(github.ref, 'refs/tags/')
        run: |
          echo "latest-tag=latest" | tr -d "\n"  >> $GITHUB_OUTPUT

      - uses: actions/github-script@v8
        id: get-tag
        if: startsWith(github.ref, 'refs/tags/')
        with:
          result-encoding: string
          script: |
            return context.payload.ref.replace('refs/tags/', '')

      - name: concat tags to list
        id: image-tags
        run: |
          TAGS=$(cat <<-END
              [
              "${{ inputs.sha || github.sha }}",
              "${{ steps.add-nightly-tag.outputs.nightly-tag }}",
              "${{ steps.add-latest-tag.outputs.latest-tag }}",
              "${{ steps.get-tag.outputs.result }}"
              ]
          END
          )
          TAGS=$(echo $TAGS | jq -c 'map(select(length > 0))')
          echo "image-tags=$TAGS" | tr -d "\n"  >> $GITHUB_OUTPUT

      - name: Get build info
        id: build-info
        run: |
          set -x
          sudo snap install yq

          export REPO_NAME=$(basename $(pwd))
          echo "services:" > /tmp/docker-compose.yml
          for i in $(find . -name docker-compose.yml); do
             docker compose -f $i config | yq '.services | select(.[].build != null and .[].image != null)' | sed 's/^/  /' >> /tmp/docker-compose.yml
          done

          cat /tmp/docker-compose.yml

          yq_pipe='.services'
          yq_pipe=$yq_pipe'| to_entries[]'
          yq_pipe=$yq_pipe'| select(.value.build != null and .value.image != null)'
          yq_pipe=$yq_pipe'| .value.build.image=.value.image'
          yq_pipe=$yq_pipe'| .value.build.service=.key'
          yq_pipe=$yq_pipe'| .value.build'
          yq_pipe=$yq_pipe'| .dockerfile=.context + "/" + .dockerfile'
          yq_pipe=$yq_pipe'| [.]'
          cat /tmp/docker-compose.yml | yq "$yq_pipe"
          BUILD_INFO=$(cat /tmp/docker-compose.yml | yq "$yq_pipe" -o=json)
          BUILD_INFO=$(echo $BUILD_INFO | jq -c -s add | sed "s|:local||g")
          echo $BUILD_INFO
          echo "result=$BUILD_INFO" | tr -d "\n"  >> $GITHUB_OUTPUT
        env:
          REPO_OWNER: ${{ vars.DOCKER_HUB_USERNAME || steps.repo-owner.outputs.result }}
          VERSION: local

  build-and-push:
    runs-on: ubuntu-latest
    name: "Build and push image ${{ matrix.build-config.service }}"
    needs:
      - build-info
    strategy:
      fail-fast: false
      matrix:
        build-config: ${{ fromJSON(needs.build-info.outputs.build-config) }}
    env:
      tags: ${{ needs.build-info.outputs.tags }}
      repo-owner: ${{ needs.build-info.outputs.repo-owner }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          ref: ${{ inputs.sha }}
          fetch-depth: 100

      - run: |
          echo "inputs:"
          cat <<-HEREDOC
          ${{ toJSON(inputs) }}
          HEREDOC

          echo "build config:"
          cat <<-HEREDOC
          ${{ toJSON(matrix.build-config) }}
          HEREDOC

          echo "build tags:"
          cat <<-HEREDOC
          ${{ env.tags }}
          HEREDOC

          echo "build repo owner:"
          cat <<-HEREDOC
          ${{ env.repo-owner }}
          HEREDOC

          if [ ! echo "${{ matrix.build-config.image }}" | grep -Eq '^[a-zA-Z0-9._/-]+$' ]; then
            echo "Error: Invalid Docker image name '${{ matrix.build-config.image }}'."
            exit 1
          fi

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Login to DockerHub
        uses: docker/login-action@v4
        with:
          username: ${{ vars.DOCKER_HUB_USERNAME || env.repo-owner }}
          password: ${{ secrets.DOCKER_HUB_PASSWORD }}

      - name: find latest commit for image tag
        id: get-latest-commit
        run: |
          set -x
          context=$( echo '${{ toJSON(matrix.build-config) }}' | jq -r '.context' | sed "s|$PWD|.|g")
          echo "context: $context"
          dockerfile=$( echo '${{ toJSON(matrix.build-config) }}' | jq -r '.dockerfile' | sed "s|$PWD|.|g")
          echo "dockerfile: $dockerfile"
          git log --stat -n 1 $context $dockerfile
          latest_commit=$(git log --pretty=format:"%H" -n 1 $context $dockerfile)
          echo "latest_commit: $latest_commit"
          echo "result=$latest_commit" | tr -d "\n"  >> $GITHUB_OUTPUT

      - name: check if image already exists
        id: check-image
        run: |
          set +e
          docker pull ${{ matrix.build-config.image }}:${{ steps.get-latest-commit.outputs.result }}
          image_exists=$?
          set -e
          if ([ $image_exists -eq 0 ]); then
            echo "image already exists"
            echo "result=true" | tr -d "\n"  >> $GITHUB_OUTPUT
          else
            echo "image does not exist"
            echo "result=false" | tr -d "\n"  >> $GITHUB_OUTPUT
          fi

      - name: Add latest commit to image tag if image does not exist
        id: add-latest-commit-to-tags-if-image-does-not-exist
        uses: actions/github-script@v8
        with:
          script: |
            if (!${{ steps.check-image.outputs.result }}) {
              return [...JSON.parse('${{ env.tags }}'), '${{ steps.get-latest-commit.outputs.result }}']
            }
            return JSON.parse('${{ env.tags }}')

      - uses: actions/github-script@v8
        id: expand-tags
        with:
          script: |
            return JSON.parse('${{ steps.add-latest-commit-to-tags-if-image-does-not-exist.outputs.result }}').map(tag => `${{ matrix.build-config.image }}:${ tag }`)

      - name: populate build args from secrets/vars
        if: steps.check-image.outputs.result == 'false'
        id: populate-build-args
        uses: actions/github-script@v8
        with:
          script: |
            const buildArgValues = {
              "SENTRY_AUTH_TOKEN" : "${{ secrets.SENTRY_AUTH_TOKEN }}",
              "SENTRY_FRONTEND_PROJECT" : "${{ vars.SENTRY_FRONTEND_PROJECT }}",
              "SENTRY_ORG" : "${{ vars.SENTRY_ORG }}",
              "SENTRY_PRINT_PROJECT" : "${{ vars.SENTRY_PRINT_PROJECT }}",
              "SENTRY_RELEASE_NAME" : "${{ inputs.sha }}",
            }
            const args = JSON.parse(`${{ toJSON(matrix.build-config.args) }}`)
            let result = ""
            for (const arg in args) {
              if (buildArgValues[arg]) {
                args[arg] = buildArgValues[arg]
              }
            }
            return args

      - name: transform build args
        if: steps.check-image.outputs.result == 'false'
        id: transform-build-args
        run: |
          set -x
          echo 'result<<EOF' >> $GITHUB_OUTPUT
          echo '${{ steps.populate-build-args.outputs.result }}' | yq -p json >> $GITHUB_OUTPUT
          echo 'EOF' >> $GITHUB_OUTPUT
          cat $GITHUB_OUTPUT

      - name: debug transform build args output
        if: steps.check-image.outputs.result == 'false'
        run: |
          echo "result: ${{ steps.transform-build-args.outputs.result }}"
          echo "result: ${{ toJSON(steps.transform-build-args.outputs) }}"

      - name: Build and push image
        uses: docker/build-push-action@v7
        if: steps.check-image.outputs.result == 'false'
        with:
          push: true
          file: ${{ matrix.build-config.dockerfile }}
          tags: ${{ join(fromJSON(steps.expand-tags.outputs.result)) }}
          context: ${{ matrix.build-config.context }}
          build-args: |
            ${{ steps.transform-build-args.outputs.result }}
          cache-from: type=gha,scope=${{ matrix.build-config.image }}
          cache-to: type=gha,scope=${{ matrix.build-config.image }},mode=max

      - name: Retag and push images
        if: steps.check-image.outputs.result == 'true'
        run: |
          for tag in $(echo '${{ env.tags }}' | jq -r '.[]'); do
            docker tag ${{ matrix.build-config.image }}:${{ steps.get-latest-commit.outputs.result }} ${{ matrix.build-config.image }}:${tag}
            docker push ${{ matrix.build-config.image }}:${tag}
          done