refactor: container build flow

Signed-off-by: Martin Buchleitner <[email protected]>

.github/workflows/containers.yaml

@@ -3,94 +3,25 @@ name: Containers - distributed-calendar
 on:
   push:
     branches: [ 'main' ]
-    paths: [ 'dapr-distributed-calendar/**' ]
+    paths: [ 'go/**', 'node/**', 'python/**' ]
   pull_request:
     branches: [ 'main' ]
-    paths: [ 'dapr-distributed-calendar/**' ]
+    paths: [ 'go/**', 'node/**', 'python/**' ]
 
-env:
-  platforms: linux/amd64
-
-  QUAY_USER: "${{ fromJSON(secrets.VAULT_KV_1D187965_OP_QUAY_ROBOT_ACCOUNT).username }}"
-  QUAY_TOKEN: "${{ fromJSON(secrets.VAULT_KV_1D187965_OP_QUAY_ROBOT_ACCOUNT).password }}"
-  BOT_ACCESS_TOKEN: "${{ fromJSON(secrets.VAULT_KV_1D187965_OP_GITHUB_INFRALOVERS).PAT }}"
-
 jobs:
   build:
     strategy:
       fail-fast: false
       matrix:
         container: [ go, node, python ]
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@v4
-
-    - name: Prepare tagging
-      id: prep
-      run: |
-        IMAGE_NAME=$(basename ${{ github.repository }})
-        IMAGE_REPO=${{ github.repository_owner }}
-        if [[ -n "${{ secrets.IMAGE_NAME }}" ]]; then
-          IMAGE_NAME="${{ secrets.IMAGE_NAME }}"
-        fi
-        if [[ -n "${{ secrets.IMAGE_REPO }}" ]]; then
-          IMAGE_REPO="${{ secrets.IMAGE_REPO }}"
-        fi
-        QUAY_IMAGE="quay.io/${IMAGE_REPO}/${IMAGE_NAME}:${{ matrix.container }}"
-        GHCR_IMAGE="ghcr.io/${{ github.repository }}-${{ matrix.container }}"
-        VERSION="dev"
-        if [[ '${{ needs.prebuild.outputs.version }}'  != '' ]]; then
-          VERSION="${{ needs.prebuild.outputs.version }}"
-        fi
-        if [ "${{ github.event_name }}" = "schedule" ]; then
-          VERSION="nightly"
-        fi
-        TAGS="${QUAY_IMAGE},${GHCR_IMAGE}:${VERSION}"
-        if [[ $VERSION =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]; then
-          TAGS="$TAGS,${GHCR_IMAGE}:latest"
-        fi
-        echo "settings tag ${TAGS}"
-        echo "tags=${TAGS}" >> $GITHUB_OUTPUT
-
-    - name: Set up Docker Buildx
-      id: buildx
-      uses: docker/setup-buildx-action@v3
-
-    - name: Set up QEMU
-      uses: docker/setup-qemu-action@v3
-      with:
-        platforms: ${{ env.platforms }}
-
-    - name: Cache Docker layers
-      uses: actions/cache@v2
-      with:
-        path: /tmp/.buildx-cache
-        key: ${{ runner.os }}-buildx-${{ github.sha }}-${{ matrix.container }}
-        restore-keys: |
-          ${{ runner.os }}-buildx-
-
-    - name: Login to Quay
-      if: ${{ github.ref_name == github.event.repository.default_branch }}
-      uses: docker/login-action@v3
-      with:
-        registry: quay.io
-        username: ${{ env.QUAY_USER }}
-        password: ${{ env.QUAY_TOKEN }}
-
-    - name: Login to GitHub Container Registry
-      if: ${{ github.ref_name == github.event.repository.default_branch }}
-      uses: docker/login-action@v3
-      with:
-        registry: ghcr.io
-        username: ${{ github.repository_owner }}
-        password: ${{ env.BOT_ACCESS_TOKEN }}
-
-    - name: Build and push
-      id: docker_build
-      uses: docker/build-push-action@v5
-      with:
-          builder: ${{ steps.buildx.outputs.name }}
-          context: ./dapr-distributed-calendar/${{ matrix.container }}/
-          push: ${{ github.ref_name == github.event.repository.default_branch }}
-          tags: ${{ steps.prep.outputs.tags }}
-          platforms: ${{ env.platforms }}
+    uses: infralovers/.github/.github/workflows/container.yml@main
+    secrets:
+      QUAY_USER: "${{ fromJSON(secrets.VAULT_KV_1D187965_OP_QUAY_ROBOT_ACCOUNT).username }}"
+      QUAY_TOKEN: "${{ fromJSON(secrets.VAULT_KV_1D187965_OP_QUAY_ROBOT_ACCOUNT).password }}"
+      BOT_ACCESS_TOKEN: "${{ fromJSON(secrets.VAULT_KV_1D187965_OP_GITHUB_INFRALOVERS).PAT }}"
+      MONDOO_SERVICE_ACCOUNT: "${{ fromJson(secrets.VAULT_KV_1D187965_OP_MONDOO_PACKER_AGENT).password }}"
+    with:
+      dockerfile: "${{ matrix.container }}/Dockerfile"
+      score: 50
+      platforms: "linux/amd64, linux/arm64"
+      release: false