action.yaml

name: Build and publish docker images
description: Builds and publish docker images to github registry
inputs:
  image-name:
    description: Image name for example lh-server
    required: true
  context:
    description: Docker build context path
    default: .
  dockerfile:
    description: Relative route of Dockerfile
    required: true
  registry:
    description: Either github or ecr
    default: github
  github-token:
    description: Github secret secrets.GITHUB_TOKEN required only if registry is github
    default: ""
  platforms:
    description: Architecture platforms
    default: "linux/amd64,linux/arm64"
  prefix:
    description: prefix to be appended to image tag ex brach-
    default: ""
  tags:
    description: "tags strategy configuration. For more information see: https://github.com/docker/metadata-action?tab=readme-ov-file#tags-input"
    default: ""
  build-args:
    description: "List of build-time variables"
    required: false
outputs:
  tags:
    description: Tags for the built image
    value: ${{ steps.meta.outputs.tags }}
runs:
  using: composite
  steps:
    - name: Registry not recognized
      shell: bash
      if: ${{ inputs.registry != 'github' && inputs.registry != 'ecr' }}
      run: |
        echo "Registry not recognized, it should be github or ecr"
        exit 1

    - name: github-token is required
      shell: bash
      if: ${{ inputs.registry == 'github' && inputs.github-token == '' }}
      run: |
        echo "github-token is required when registry is github"
        exit 1

    - name: Set up QEMU
      uses: docker/setup-qemu-action@v3

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3

    - name: Log in to github registry
      if: ${{ inputs.registry == 'github'}}
      uses: docker/login-action@v3
      with:
        registry: ghcr.io
        username: ${{ github.actor }}
        password: ${{ inputs.github-token }}

    - name: Configure AWS credentials
      if: ${{ inputs.registry == 'ecr' }}
      uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: arn:aws:iam::637423582379:role/GithubActions-ECR
        role-session-name: gha-ecr
        aws-region: us-west-2

    - name: Login to Amazon ECR
      id: login-ecr
      if: ${{ inputs.registry == 'ecr' }}
      uses: aws-actions/amazon-ecr-login@v2

    - name: Set DOCKER_IMAGE to github
      if: ${{ inputs.registry == 'github'}}
      shell: bash
      run: |
        echo DOCKER_IMAGE=ghcr.io/${{ github.repository }}/${{ inputs.image-name }} >> $GITHUB_ENV

    - name: Set DOCKER_IMAGE to ecr
      if: ${{ inputs.registry == 'ecr' }}
      shell: bash
      run: |
        echo DOCKER_IMAGE=${{ steps.login-ecr.outputs.registry }}/${{ inputs.image-name }} >> $GITHUB_ENV

    - name: Extract metadata (tags, labels) for Docker
      uses: docker/metadata-action@v5
      id: meta
      with:
        images: |
          ${{ env.DOCKER_IMAGE }}
        flavor: |
          prefix=${{ inputs.prefix }}
        tags: ${{ inputs.tags }}

    - name: Build and push Docker images
      uses: docker/build-push-action@v5
      with:
        context: ${{ inputs.context }}
        file: ${{ inputs.dockerfile }}
        platforms: ${{ inputs.platforms }}
        push: true
        tags: ${{ steps.meta.outputs.tags }}
        labels: ${{ steps.meta.outputs.labels }}
        build-args: ${{ inputs.build-args }}
    
    # - name: Extract and export first tag
    #   id: extract-tag
    #   shell: bash
    #   run: |
    #     first_tag=$(echo "${{ steps.meta.outputs.tags }}" | head -n 1)
    #     echo "FIRST_TAG=$first_tag" >> $GITHUB_ENV

    # - name: Scan Docker image
    #   uses: aquasecurity/trivy-action@0.24.0
    #   with:
    #     image-ref: ${{ env.FIRST_TAG }}  # Use the built image tag
    #     severity: HIGH,CRITICAL  # Specify severity levels
    #     ignore-unfixed: true  # Optional: Ignore unfixed vulnerabilities
    #     exit-code: '0'

    - name: Annotate image
      shell: bash
      run: |
        echo "::notice title=Published Docker Image::${{ steps.meta.outputs.tags }}"