action.yml

---
name: "Docker - Create images manifests"
description: |
  Action to create built images manifests.
  It uses the Docker Buildx plugin to create manifests for the built images.
  It requires the Docker Buildx plugin to be installed and configured.
  It supports creating manifests for multiple images and platforms at once.
author: hoverkraft
branding:
  icon: package
  color: blue

inputs:
  oci-registry:
    description: "OCI registry where to pull and push images"
    default: "ghcr.io"
    required: true
  oci-registry-username:
    description: Username used to log against the OCI registry.
      See https://github.com/docker/login-action#usage.
    default: ${{ github.repository_owner }}
    required: true
  oci-registry-password:
    description: |
      Password or personal access token used to log against the OCI registry.
      Can be passed in using `secrets.GITHUB_TOKEN`.
      See https://github.com/docker/login-action#usage.
    default: ${{ github.token }}
    required: true
  built-images:
    description: |
      Built images data.
      Example:
      ```json
      {
        "application": {
          "name": "application",
          "registry": "ghcr.io",
          "repository": "my-org/my-repo/application",
          "tags": ["pr-63-5222075","pr-63"],
          "images": [
            "ghcr.io/my-org/my-repo/application@sha256:d31aa93410434ac9dcfc9179cac2cb1fd4d7c27f11527addc40299c7c675f49d",
            "ghcr.io/my-org/my-repo/application@sha256:0f5aa93410434ac9dcfc9179cac2cb1fd4d7c27f11527addc40299c7c675f402",
          ],
          "annotations": {
            "org.opencontainers.image.created": "2021-09-30T14:00:00Z",
            "org.opencontainers.image.description": "Application image"
          },
          "platforms": ["linux/amd64", "linux/arm64"],
          "multi-platform": true
        }
      }
      ```
    required: true

outputs:
  built-images:
    description: |
      Built images data.
      Example:
      ```json
      {
        "application": {
          "name": "application",
          "registry": "ghcr.io",
          "repository": "my-org/my-repo/application",
          "tags": ["pr-63-5222075","pr-63"],
          "digest": "sha256:d31aa93410434ac9dcfc9179cac2cb1fd4d7c27f11527addc40299c7c675f49d",
          "images": [
            "ghcr.io/my-org/my-repo/application:pr-63-5222075@sha256:d31aa93410434ac9dcfc9179cac2cb1fd4d7c27f11527addc40299c7c675f49d",
            "ghcr.io/my-org/my-repo/application:pr-63@sha256:d31aa93410434ac9dcfc9179cac2cb1fd4d7c27f11527addc40299c7c675f49d"
          ],
          "annotations": {
            "org.opencontainers.image.created": "2021-09-30T14:00:00Z",
            "org.opencontainers.image.description": "Application image"
          },
          "platforms": ["linux/amd64", "linux/arm64"]
        }
      }
      ```
    value: ${{ steps.get-built-images-digest.outputs.built-images }}

runs:
  using: "composite"
  steps:
    - uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
      with:
        # FIXME: upgrade version when available (https://github.com/docker/buildx/releases)
        version: v0.30.1
        # FIXME: upgrade version when available (https://hub.docker.com/r/moby/buildkit)
        driver-opts: |
          image=moby/buildkit:v0.26.2

    - uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
      with:
        registry: ${{ inputs.oci-registry }}
        username: ${{ inputs.oci-registry-username }}
        password: ${{ inputs.oci-registry-password }}

    - id: create-images-manifests
      name: Create images manifests and push
      uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
      with:
        script: |
          const builtImagesInput = `${{ inputs.built-images }}`;
          let builtImages = null;
          try {
            builtImages = JSON.parse(builtImagesInput);
          } catch (error) {
            throw new Error(`"built-images" input is not a valid JSON: ${error}`);
          }

          // Helper function to validate image data
          function validateImage(builtImage) {
            if (!builtImage.images || builtImage.images.length === 0) {
              throw new Error(`No images found for "${builtImage.name}"`);
            }
          }

          // Helper function to build annotations options
          function buildAnnotationsOption(annotations) {
            const annotationLevels = ["index"];
            return Object.keys(annotations)
              .map(annotation => annotationLevels
                .map(annotationLevel => `--annotation "${annotationLevel}:${annotation}=${annotations[annotation]}"`)
              )
              .flat()
              .join(" ");
          }

          // Helper function to create multiarch manifest
          async function createMultiarchManifest(builtImage, imagesWithTags) {
            const platformsOption = builtImage.platforms.map(platform => `--platform ${platform}`).join(" ");
            const tagsOption = imagesWithTags.map(image => `--tag ${image}`).join(" ");
            const sources = builtImage.images.join(" ");
            const annotationsOption = buildAnnotationsOption(builtImage.annotations);

            const createManifestCommand = `docker buildx imagetools create ${platformsOption} ${annotationsOption} ${tagsOption} ${sources}`;

            await exec.exec(createManifestCommand);
            core.debug(`Create manifest for "${builtImage.name}" ("${createManifestCommand}") executed`);

            builtImage.images = imagesWithTags;
          }

          // Helper function to build image tags
          function buildImageTags(builtImage) {
            const imagesWithTags = [];
            for (const tag of builtImage.tags) {
              const imageWithTag = `${builtImage.registry}/${builtImage.repository}:${tag}`;
              imagesWithTags.push(imageWithTag);
            }
            return imagesWithTags;
          }

          // Process each image
          const commands = Object.keys(builtImages).map(imageName => {
            const builtImage = builtImages[imageName];
            const imagesWithTags = buildImageTags(builtImage);
            return new Promise(async (resolve, reject) => {
              try {
                if(!builtImage["multi-platform"]) {
                  core.debug(`Skipping manifest creation for "${builtImage.name}" as "multi-platform" is not set to true`);
                  builtImage.images = imagesWithTags;
                  return resolve();
                }

                await createMultiarchManifest(builtImage, imagesWithTags);
                resolve();
              } catch (error) {
                reject(error);
              }
            });
          });

          await Promise.all(commands);

          core.debug("Manifest created and pushed");

          core.setOutput("built-images", JSON.stringify(builtImages));

    - name: Get built images digest
      id: get-built-images-digest
      uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
      with:
        script: |
          const builtImagesOutputs = ${{ toJson(steps.create-images-manifests.outputs.built-images) }};
          let builtImages = null;
          try {
            builtImages = JSON.parse(builtImagesOutputs);
          } catch (error) {
            throw new Error(`"built-images" output is not a valid JSON: ${error}`);
          }

          const getImageDigest = async function(image) {
            // Check if the image already has a digest
            if (image.match(/@/)) {
              core.debug(`Image "${image}" already has a digest, skipping inspection.`);
              return image;
            }

            const inspectImageCommand = `docker buildx imagetools inspect ${image}`;
            core.debug(`Inspecting image "${image}" with command: "${inspectImageCommand}"`);

            const { stdout } = await exec.getExecOutput(inspectImageCommand);

            core.debug(`Inspect image "${image}" ("${inspectImageCommand}") executed: ${stdout}`);

            if (!stdout) {
              throw new Error(`Failed to retrieve manifest for image "${image}": "${inspectImageCommand}" returned empty output`);
            }

            // Retrieve digest from the manifest
            const digestRegex = /Digest:\s+([a-z0-9]+:[a-z0-9]{64})/;
            const digestMatch = stdout.match(digestRegex);
            if (!digestMatch || digestMatch.length < 2) {
              throw new Error(`Failed to retrieve digest for image "${image}": "${inspectImageCommand}" returned unexpected output: ${stdout}`);
            }

            const digest = digestMatch[1];
            if (!digest) {
              throw new Error(`Failed to retrieve digest for image "${image}": "${inspectImageCommand}" returned empty digest`);
            }

            core.debug(`Digest for image "${image}" is "${digest}"`);
            return digest;
          }

          await Promise.all(Object.keys(builtImages).map(async (imageName) => {
            const builtImage = builtImages[imageName];
            const digest = await getImageDigest(builtImage.images[0]);

            // Update built image with the digest
            builtImage.digest = digest;
            builtImage.images = builtImage.images.map(image => `${image}@${digest}`);
          }));

          core.setOutput("built-images", JSON.stringify(builtImages));