wc-sanitize-image-name.yml

---
name: Sanitize Image Name

on:
  workflow_call:
    inputs:
      image-name:
        required: true
        type: string
      registry:
        required: true
        type: string
      runner-labels:
        required: true
        type: string
    outputs:
      image-basename:
        description: The sanitized base name of the image (without registry or tag)
        value: ${{ jobs.sanitize.outputs.image-basename }}
      image-name:
        description: The sanitized name of the image (without registry or tag)
        value: ${{ jobs.sanitize.outputs.image-name }}
      fully-qualified-image-name:
        description: The fully qualified name of the image including registry (but without tag)
        value: ${{ jobs.sanitize.outputs.fully-qualified-image-name }}

permissions: {}

jobs:
  sanitize:
    name: Sanitize Image Name
    runs-on: ${{ fromJson(inputs.runner-labels) }}
    outputs:
      image-basename: ${{ steps.sanitize-image-name.outputs.sanitized-basename }}
      image-name: ${{ steps.sanitize-image-name.outputs.sanitized-image-name }}
      fully-qualified-image-name: ${{ inputs.registry }}/${{ steps.sanitize-image-name.outputs.sanitized-image-name }}
    steps:
      - uses: step-security/harden-runner@f808768d1510423e83855289c910610ca9b43176 # v2.17.0
        with:
          disable-sudo-and-containers: true
          allowed-endpoints: >
            api.github.com:443
      - name: Sanitize image name
        id: sanitize-image-name
        env:
          IMAGE_NAME: ${{ inputs.image-name }}
        run: |
          set -Eeuo pipefail

          # Split all image name components (on '/') and sanitize each component independently.
          # Rules: lowercase; allowed chars a-z0-9._- ; collapse invalid sequences to single '-'; trim leading/trailing '-'.
          IFS='/' read -r -a PARTS <<< "$IMAGE_NAME"
          SANITIZED_PARTS=()

          for PART in "${PARTS[@]}"; do
            SANITIZED_PART=$(echo "$PART" | tr '[:upper:]' '[:lower:]' | sed -E 's/[^a-z0-9._-]+/-/g' | sed -E 's/^-+|-+$//g')
            if [ -z "$SANITIZED_PART" ]; then
              echo "Invalid or empty component after sanitization in image component: '$PART', please correct your image name: '$IMAGE_NAME'" >&2
              exit 1
            fi
            SANITIZED_PARTS+=("$SANITIZED_PART")
          done

          SANITIZED_IMAGE_NAME=$(IFS='/'; echo "${SANITIZED_PARTS[*]}")
          SANITIZED_BASENAME=${SANITIZED_PARTS[-1]}
          echo "sanitized-image-name=$SANITIZED_IMAGE_NAME" >> "$GITHUB_OUTPUT"
          echo "sanitized-basename=$SANITIZED_BASENAME" >> "$GITHUB_OUTPUT"