build-and-push.yaml

name: Build and Push

on:
  workflow_call:
    inputs:
      version:
        description: "Version tag for the image (e.g. v1.2.3)"
        required: false
        type: string
    outputs:
      digest:
        description: "The published image manifest digest (sha256:...)"
        value: ${{ jobs.merge.outputs.digest }}

env:
  REGISTRY_IMAGE: ghcr.io/${{ github.repository }}
  REGISTRY_PUSH: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}

permissions:
  packages: write
  id-token: write # Required for keyless cosign signing

jobs:
  build:
    runs-on: ${{ matrix.platform.runner }}
    strategy:
      fail-fast: false
      matrix:
        platform:
          - name: linux/amd64
            runner: ubuntu-latest
          - name: linux/arm64
            runner: ubuntu-24.04-arm
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - name: Prepare
        run: |
          platform=${{ matrix.platform.name }}
          echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV

      - name: Get Build timestamp and branch name
        run: |
          echo "BUILD_TIMESTAMP=$(date +'%s')" >> $GITHUB_ENV
          if [[ -n "${{ inputs.version }}" ]]; then
            echo "VERSION=${{ inputs.version }}" >> $GITHUB_ENV
          else
            echo "VERSION=$( echo ${{ github.head_ref || github.ref_name }} | tr '/' '-' )" >> $GITHUB_ENV
          fi

      - name: Docker tags & labels
        id: meta
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
        with:
          images: ${{ env.REGISTRY_IMAGE }}
          # generate Docker tags:
          # - type=raw,VERSION -> branch name
          # - type=ref,event=tag -> tag name
          # - type=sha,format=long,prefix= -> commit sha
          tags: |
            type=raw,${{ env.VERSION }}
            type=raw,latest,enable=${{ github.ref == 'refs/heads/main' }}
            type=ref,event=tag
            type=sha,format=long,prefix=

      - name: Set up QEMU
        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4

      - name: Login to GHCR
        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push by digest
        id: build
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
        with:
          platforms: ${{ matrix.platform.name }}
          build-args: |
            VERSION=${{ env.VERSION }}
            BUILD_TIMESTAMP=${{ env.BUILD_TIMESTAMP }}
            COMMIT_HASH=${{ github.sha }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          outputs: type=image,name=${{ env.REGISTRY_IMAGE }},push-by-digest=true,name-canonical=true,push=${{ env.REGISTRY_PUSH }}

      - name: Export digest
        run: |
          mkdir -p /tmp/digests
          digest="${{ steps.build.outputs.digest }}"
          touch "/tmp/digests/${digest#sha256:}"

      - name: Upload digest
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: digests-${{ env.PLATFORM_PAIR }}
          path: /tmp/digests/*
          if-no-files-found: error
          retention-days: 1

  merge:
    runs-on: ubuntu-latest
    needs:
      - build
    outputs:
      digest: ${{ steps.inspect.outputs.digest }}
    steps:
      - name: Download digests
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          path: /tmp/digests
          pattern: digests-*
          merge-multiple: true

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4

      - name: Get branch name
        run: |
          if [[ -n "${{ inputs.version }}" ]]; then
            echo "VERSION=${{ inputs.version }}" >> $GITHUB_ENV
          else
            echo "VERSION=$( echo ${{ github.head_ref || github.ref_name }} | tr '/' '-' )" >> $GITHUB_ENV
          fi

      - name: Docker tags & labels
        id: meta
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
        with:
          images: ${{ env.REGISTRY_IMAGE }}
          # generate Docker tags:
          # - type=raw,VERSION -> branch name
          # - type=ref,event=tag -> tag name
          # - type=sha,format=long,prefix= -> commit sha
          tags: |
            type=raw,${{ env.VERSION }}
            type=raw,latest,enable=${{ github.ref == 'refs/heads/main' }}
            type=ref,event=tag
            type=sha,format=long,prefix=

      - name: Login to GHCR
        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Create manifest list and push
        if: env.REGISTRY_PUSH == 'true'
        working-directory: /tmp/digests
        run: |
          docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
            $(printf '${{ env.REGISTRY_IMAGE }}@sha256:%s ' *)

      - name: Inspect image
        id: inspect
        if: env.REGISTRY_PUSH == 'true'
        run: |
          docker buildx imagetools inspect ${{ env.REGISTRY_IMAGE }}:${{ steps.meta.outputs.version }}
          DIGEST=$(docker buildx imagetools inspect ${{ env.REGISTRY_IMAGE }}:${{ steps.meta.outputs.version }} | grep -m1 '^Digest:' | awk '{print $2}')
          echo "digest=$DIGEST" >> $GITHUB_OUTPUT

      - name: Install Cosign
        if: env.REGISTRY_PUSH == 'true'
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2

      - name: Sign image
        if: env.REGISTRY_PUSH == 'true'
        run: cosign sign --yes ${{ env.REGISTRY_IMAGE }}@${{ steps.inspect.outputs.digest }}