docker-build-ecr.yml

name: Docker Build (ECR)
on:
  workflow_call:
    inputs:
      image_names:
        description: 'JSON array of Docker image names (e.g., ["rudderstack/rudder-server", "rudderlabs/another-image"])'
        required: true
        type: string
      tags:
        description: 'Docker tags configuration'
        required: true
        type: string
      dockerfile:
        description: 'Path to Dockerfile'
        required: false
        type: string
        default: 'Dockerfile'
      aws_ecr_iam_role_arn:
        description: 'AWS ECR IAM Role ARN'
        required: true
        type: string
      aws_ecr_region:
        description: 'AWS ECR Region'
        required: true
        type: string
      race:
        description: 'build with race detector'
        required: false
        type: boolean
        default: false
    secrets:
      ENTERPRISE_TOKEN:
        required: false

permissions:
  id-token: write # allows the JWT to be requested from GitHub's OIDC provider
  contents: read  # This is required for actions/checkout

env:
  arch_amd64: amd64
  arch_arm64: arm64

jobs:
  docker-meta:
    if: github.actor != 'dependabot[bot]'
    runs-on: ubuntu-latest
    outputs:
      labels: ${{ steps.meta.outputs.labels }}
      build-date: ${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.created'] }}
      version: ${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.version'] }}
      revision: ${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }}
      tags: ${{ steps.meta.outputs.tags }}
      arm64_tags: ${{ steps.arm64_meta.outputs.tags }}
      arm64_labels: ${{ steps.arm64_meta.outputs.labels }}
      amd64_tags: ${{ steps.amd64_meta.outputs.tags }}
      amd64_labels: ${{ steps.amd64_meta.outputs.labels }}
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          egress-policy: audit

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
        with:
          role-to-assume: ${{ inputs.aws_ecr_iam_role_arn }}
          aws-region: ${{ inputs.aws_ecr_region }}
          role-session-name: ${{ github.event.repository.name }}

      - name: Login to ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@d539f0932e70871a027e9d5a9d8fc38589180a64 # v2.1.6

      - name: Process image names
        id: process-images
        env:
          IMAGE_NAMES: ${{ inputs.image_names }}
          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
        run: |          # Convert JSON array to multiline format with "name=" prefix
          FORMATTED_IMAGES=$(echo "$IMAGE_NAMES" | jq -r --arg registry "$ECR_REGISTRY" '.[] | "name=\($registry)/\(.)"')
          echo "formatted_images<<EOF" >> "$GITHUB_OUTPUT"
          echo "$FORMATTED_IMAGES" >> "$GITHUB_OUTPUT"
          echo "EOF" >> "$GITHUB_OUTPUT"

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
        with:
          images: ${{ steps.process-images.outputs.formatted_images }}
          tags: ${{ inputs.tags }}

      - name: Docker arm64 meta
        id: arm64_meta
        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
        with:
          images: |
            ${{ steps.process-images.outputs.formatted_images }}
          tags: ${{ inputs.tags }}
          flavor: |
            suffix=-${{ env.arch_arm64 }},onlatest=true

      - name: Docker amd64 meta
        id: amd64_meta
        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
        with:
          images: |
            ${{ steps.process-images.outputs.formatted_images }}
          tags: ${{ inputs.tags }}
          flavor: |
            suffix=-${{ env.arch_amd64 }},onlatest=true

  docker-build:
    needs: docker-meta
    strategy:
      matrix:
        build-config:
          - os: [ self-hosted, Linux, ARM64, ubuntu-22 ]
            tags: ${{ needs.docker-meta.outputs.arm64_tags }}
            labels: ${{ needs.docker-meta.outputs.arm64_labels }}
            platform: linux/arm64
            race: ${{ inputs.race }}
          - os: ubuntu-latest
            tags: ${{ needs.docker-meta.outputs.amd64_tags }}
            labels: ${{ needs.docker-meta.outputs.amd64_labels }}
            platform: linux/amd64
            race: ${{ inputs.race }}
    runs-on: ${{ matrix.build-config.os }}
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          egress-policy: audit

      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
        with:
          role-to-assume: ${{ inputs.aws_ecr_iam_role_arn }}
          aws-region: ${{ inputs.aws_ecr_region }}
          role-session-name: ${{ github.event.repository.name }}

      - name: Login to ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@d539f0932e70871a027e9d5a9d8fc38589180a64 # v2.1.6

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
        with:
          buildkitd-config-inline: |
            [registry."docker.io"]
              mirrors = ["422074288268.dkr.ecr.us-east-1.amazonaws.com/docker-hub"]

      - name: Build, scan and push
        uses: rudderlabs/build-scan-push-action@865b4253caa57f8f20cd109e0efc1affe3a64939 # v2.2.0
        with:
          context: .
          file: ./${{ inputs.dockerfile }}
          platforms: ${{ matrix.build-config.platform }}
          push: true
          tags: ${{ matrix.build-config.tags }}
          labels: ${{ matrix.build-config.labels }}
          build-args: |
            ENTERPRISE_TOKEN=${{ secrets.ENTERPRISE_TOKEN }}
            BUILD_DATE=${{ needs.docker-meta.outputs.build-date }}
            VERSION=${{ needs.docker-meta.outputs.version }}
            COMMIT_HASH=${{ github.sha }}
            REVISION=${{ needs.docker-meta.outputs.revision }}
            ${{ matrix.build-config.race == 'true' && 'RACE_ENABLED=TRUE CGO_ENABLED=1' || '' }}

  create-manifest:
    runs-on: ubuntu-latest
    needs: [ docker-build, docker-meta ]
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          egress-policy: audit

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
        with:
          role-to-assume: ${{ inputs.aws_ecr_iam_role_arn }}
          aws-region: ${{ inputs.aws_ecr_region }}
          role-session-name: ${{ github.event.repository.name }}

      - name: Login to ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@d539f0932e70871a027e9d5a9d8fc38589180a64 # v2.1.6

      - name: Create multi-arch manifest for Docker
        run: |
          while read -r tag; do
            echo "$tag"
            arm_tag=$(echo "${{ needs.docker-meta.outputs.arm64_tags }}" | grep "$tag")
            echo "$arm_tag"
            amd_tag=$(echo "${{ needs.docker-meta.outputs.amd64_tags }}" | grep "$tag")
            echo "$amd_tag"
            docker buildx imagetools create -t $tag $arm_tag $amd_tag
          done <<< "${{ needs.docker-meta.outputs.tags }}"