build-container.yml

name: Build container

on:
  workflow_call:
    inputs:
      context:
        description: "Path to use for build context"
        required: true
        type: string
      file:
        description: "Path to Dockerfile"
        required: true
        type: string
      name:
        description: "Container name"
        required: true
        type: string
      runs-on-amd64:
        description: "Runner label to use for amd64 jobs"
        required: true
        type: string
      runs-on-arm64:
        description: "Runner label to use for arm64 jobs"
        required: true
        type: string
      runs-on-manifest:
        description: "Runner label for the job that combines the amd64 and arm64 builds into one multi-arch manifest"
        required: true
        type: string
      existing-image:
        description: "Digest reference (ghcr.io/...@sha256:...) of a trusted container already built from this exact context. When set, nothing is built and this container is used."
        required: false
        type: string
        default: ""
      runs-on-existing:
        description: "Runner label for the one-step job that runs instead of the build when existing-image is set"
        required: true
        type: string
      context-tag:
        description: "Tag naming this build context (ctx-...). Trusted (push) builds add it to the container so later runs can find it as existing-image."
        required: false
        type: string
        default: ""
    outputs:
      path:
        description: "Digest reference to the container this run uses: existing-image, or the one it just built"
        value: ${{ inputs.existing-image || jobs.create-manifest.outputs.path }}

jobs:
  use-existing:
    # Runs instead of the build jobs. A called workflow must run at least one
    # job: if all of them are skipped, the caller counts as skipped, and so
    # does every job that needs it (lint, depends, src, test).
    name: Use existing container
    if: ${{ inputs.existing-image != '' }}
    runs-on: ${{ inputs.runs-on-existing }}
    steps:
      - name: Report existing container
        env:
          NAME: ${{ inputs.name }}
          EXISTING_IMAGE: ${{ inputs.existing-image }}
        run: |
          echo "::notice title=${NAME}::Using existing container ${EXISTING_IMAGE}, build skipped"

  build-amd64:
    name: Build container (amd64)
    if: ${{ inputs.existing-image == '' }}
    runs-on: ${{ inputs.runs-on-amd64 }}
    outputs:
      tag: ${{ steps.prepare.outputs.tag }}
      repo: ${{ steps.prepare.outputs.repo }}
      digest: ${{ steps.build.outputs.digest }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v6
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          allow-unsafe-pr-checkout: true
          persist-credentials: false

      - name: Prepare variables
        id: prepare
        run: |
          BRANCH_NAME=$(echo "${GITHUB_REF##*/}" | tr '[:upper:]' '[:lower:]')
          REPO_NAME=$(echo "${{ github.repository }}" | tr '[:upper:]' '[:lower:]')
          echo "tag=${BRANCH_NAME}" >> "$GITHUB_OUTPUT"
          echo "repo=${REPO_NAME}" >> "$GITHUB_OUTPUT"

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push Docker image
        id: build
        uses: docker/build-push-action@v7
        with:
          context: ${{ inputs.context }}
          file: ${{ inputs.file }}
          push: true
          platforms: linux/amd64
          # Only trusted events may write tags that other runs read
          tags: |
            ghcr.io/${{ steps.prepare.outputs.repo }}/${{ inputs.name }}:${{ github.event_name == 'push' && format('trusted-{0}', hashFiles(inputs.file)) || 'untrusted' }}-amd64
          cache-from: |
            type=registry,ref=ghcr.io/${{ steps.prepare.outputs.repo }}/${{ inputs.name }}:trusted-${{ hashFiles(inputs.file) }}-amd64
          cache-to: type=inline

  build-arm64:
    name: Build container (arm64)
    if: ${{ inputs.existing-image == '' }}
    runs-on: ${{ inputs.runs-on-arm64 }}
    outputs:
      digest: ${{ steps.build.outputs.digest }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v6
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          allow-unsafe-pr-checkout: true
          persist-credentials: false

      - name: Prepare variables
        id: prepare
        run: |
          BRANCH_NAME=$(echo "${GITHUB_REF##*/}" | tr '[:upper:]' '[:lower:]')
          REPO_NAME=$(echo "${{ github.repository }}" | tr '[:upper:]' '[:lower:]')
          echo "tag=${BRANCH_NAME}" >> "$GITHUB_OUTPUT"
          echo "repo=${REPO_NAME}" >> "$GITHUB_OUTPUT"

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push Docker image
        id: build
        uses: docker/build-push-action@v7
        with:
          context: ${{ inputs.context }}
          file: ${{ inputs.file }}
          push: true
          platforms: linux/arm64
          # Only trusted events may write tags that other runs read
          tags: |
            ghcr.io/${{ steps.prepare.outputs.repo }}/${{ inputs.name }}:${{ github.event_name == 'push' && format('trusted-{0}', hashFiles(inputs.file)) || 'untrusted' }}-arm64
          cache-from: |
            type=registry,ref=ghcr.io/${{ steps.prepare.outputs.repo }}/${{ inputs.name }}:trusted-${{ hashFiles(inputs.file) }}-arm64
          cache-to: type=inline

  create-manifest:
    name: Create multi-arch manifest
    if: ${{ inputs.existing-image == '' }}
    runs-on: ${{ inputs.runs-on-manifest }}
    needs: [build-amd64, build-arm64]
    outputs:
      path: ${{ steps.manifest.outputs.path }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v6
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          allow-unsafe-pr-checkout: true
          persist-credentials: false

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4
        with:
          # imagetools create --metadata-file needs buildx v0.32.0 or later,
          # newer than some runner images ship.
          version: v0.38.2

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Create and push multi-arch manifest
        id: manifest
        env:
          TRUSTED: ${{ github.event_name == 'push' }}
          CONTEXT_TAG: ${{ inputs.context-tag }}
          REPO_NAME: ${{ needs.build-amd64.outputs.repo }}
          IMAGE_NAME: ${{ inputs.name }}
          TAG: ${{ needs.build-amd64.outputs.tag }}
          HASH_TAG: ${{ hashFiles(inputs.file) }}
          AMD64_DIGEST: ${{ needs.build-amd64.outputs.digest }}
          ARM64_DIGEST: ${{ needs.build-arm64.outputs.digest }}
        run: |
          REPO="ghcr.io/${REPO_NAME}/${IMAGE_NAME}"

          if [[ "$TRUSTED" == "true" ]]; then
            TAGS=(-t "${REPO}:${HASH_TAG}" -t "${REPO}:${TAG}" -t "${REPO}:latest")
            # Lets later runs with the same context use this container (resolve_ci_images.py)
            if [[ -n "$CONTEXT_TAG" ]]; then
              TAGS+=(-t "${REPO}:${CONTEXT_TAG}")
            fi
          else
            TAGS=(-t "${REPO}:untrusted")
          fi

          # Use this run's digests: tags can be moved by concurrent runs
          docker buildx imagetools create --metadata-file "${RUNNER_TEMP}/manifest.json" "${TAGS[@]}" \
            "${REPO}@${AMD64_DIGEST}" \
            "${REPO}@${ARM64_DIGEST}"

          DIGEST=$(jq -er '."containerimage.descriptor".digest' "${RUNNER_TEMP}/manifest.json")
          echo "path=${REPO}@${DIGEST}" >> "$GITHUB_OUTPUT"