build-push-docker.yml

name: Build and push Docker image

permissions:
  contents: write
  pull-requests: write
  id-token: write
  attestations: write
  packages: write

on:
  workflow_dispatch:
    inputs:
      ref:
        description: 'The zksync-anvil version to generate docker image from. If empty, branch that triggered the workflow is used.'
        required: false
        default: ''
      tag:
        description: 'The tag to use for the Docker image. Leave empty to skip pushing the image.'
        required: false
        default: ''
  workflow_call:
    inputs:
      tag:
        type: string
        description: 'The tag to use for the Docker image.'
        required: true


concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: false

jobs:

  build-push-image:
    name: Build and Push Docker Image
    runs-on: matterlabs-ci-runner-high-performance
    env:
      DOCKERHUB_IMAGE: us-docker.pkg.dev/matterlabs-infra/matterlabs-docker/anvil-zksync
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.ref || '' }}

      - name: Login to GAR
        run: gcloud auth configure-docker us-docker.pkg.dev -q

      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set Up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build and push Docker image
        uses: docker/build-push-action@v6
        id: push
        with:
          context: .
          push: ${{ inputs.tag != '' }}
          platforms: 'linux/amd64,linux/arm64'
          cache-from: type=gha
          cache-to: type=gha,mode=max
          tags: |
            ghcr.io/${{ github.repository }}:${{ inputs.tag }}
            ${{ env.DOCKERHUB_IMAGE }}:${{ inputs.tag }}

      - name: Generate docker image attestation
        if: ${{ inputs.tag != '' }}
        uses: actions/attest-build-provenance@v1
        with:
          subject-name: ghcr.io/${{ github.repository }}
          subject-digest: ${{ steps.push.outputs.digest }}
          push-to-registry: true

      - name: Print image digest to summary
        if: ${{ inputs.tag != '' }}
        run: |
          echo "Image tags: ghcr.io/${{ github.repository }}:${{ inputs.tag }}" >> "${GITHUB_STEP_SUMMARY}"
          echo "Image tags: ${{ env.DOCKERHUB_IMAGE }}:${{ inputs.tag }}" >> "${GITHUB_STEP_SUMMARY}"