oci-ci.yaml

name: OCI Image CI
on:
  workflow_call:
    inputs:
      artifact_registry_location:
        type: string
        default: "europe"
        description: Artifact registry region name (e.g. "europe", "europe-north1").
      environment:
        type: string
        description: The environment name to use. If set variables will be loaded from env.$(ENVIRONMENT)
      publish:
        type: boolean
        default: false
        description: Set to true to publish the OCI Image produced by this workflow.
      docker-compose-service:
        type: string
        description: The docker compose service providing the CI executables validate, build and publish
      workload_identity_provider:
        type: string
      service_account:
        type: string
      xdg_cache_hash:
        type: string
        default: ""
        description: The path argument for the GitHub Actions function hashFiles.
      tags:
        type: string
        default: ""
        description: The tags (separated by space) to use for the image.
    secrets:
      REVIEWBOT_GITHUB_TOKEN:
        required: true
    outputs:
      image:
        value: ${{ jobs.oci-ci.outputs.image }}
        description: The full OCI Image reference.
      image_tag:
        value: ${{ jobs.oci-ci.outputs.image_tag }}
        description: The OCI Image tag.
defaults:
  run:
    shell: bash
env:
  XDG_CACHE_HOME: ${{ github.workspace }}/.cache/xdg
jobs:
  oci-ci:
    name: OCI Image CI
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      id-token: write
      packages: read
    outputs:
      image: ${{ steps.metadata.outputs.image }}
      image_tag: ${{ steps.metadata.outputs.image_tag }}
      image_digest: ${{ steps.metadata.outputs.image_digest }}
    steps:
      - uses: actions/checkout@v6
      - name: Set up QEMU
        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
      - name: Cache xdg
        if: ${{ inputs.xdg_cache_hash != '' }}
        uses: actions/cache@v5
        with:
          path: ${{ env.XDG_CACHE_HOME }}
          key: xdg-${{ github.repository }}-${{ github.job }}-${{ inputs.xdg_cache_hash }}
          restore-keys: |
            xdg-${{ github.repository }}-${{ github.job }}-${{ inputs.xdg_cache_hash }}
            xdg-${{ github.repository }}-${{ github.job }}-
      - name: Login to GitHub Container Registry
        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Configure access to internal and private GitHub repos
        run: git config --global url."https://${{ secrets.REVIEWBOT_GITHUB_TOKEN }}:x-oauth-basic@github.com/coopnorge".insteadOf "https://github.com/coopnorge"
      - name: Build devtools
        run: docker compose build ${{ inputs.docker-compose-service }}
      - name: Validate
        run: docker compose run --rm ${{ inputs.docker-compose-service }} validate VERBOSE=all ENVIRONMENT=${{ inputs.environment }}
      - name: Build
        run: docker compose run --rm ${{ inputs.docker-compose-service }} build VERBOSE=all ENVIRONMENT=${{ inputs.environment }} OCI_TAG_SUFFIX_USER="${{ inputs.tags }}"
      - name: Autenticate with GCP
        if: ${{ inputs.publish }}
        uses: "google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093" # v3.0.0
        with:
          workload_identity_provider: ${{ inputs.workload_identity_provider }}
          service_account: ${{ inputs.service_account }}
          create_credentials_file: true
      - name: Configure Google Cloud Artifact Registry for Docker
        if: ${{ inputs.publish }}
        run: gcloud auth print-access-token | docker login https://${{ inputs.artifact_registry_location }}-docker.pkg.dev -u oauth2accesstoken --password-stdin
      - name: Publish with Tag
        if: ${{ inputs.publish && inputs.tags != ''}}
        run: docker compose run --rm ${{ inputs.docker-compose-service }} publish VERBOSE=all ENVIRONMENT=${{ inputs.environment }} OCI_TAG_SUFFIX_USER="${{ inputs.tags }}"
      - name: Publish
        if: ${{ inputs.publish }}
        run: docker compose run --rm ${{ inputs.docker-compose-service }} publish VERBOSE=all ENVIRONMENT=${{ inputs.environment }}
      - name: Output Image Metadata
        id: metadata
        run: |
          IMAGE_NAME=$(docker compose run --rm ${{ inputs.docker-compose-service }} yq --output-format=yaml '.["image.name"]' oci-metadata.json)
          IMAGE_NAME=${IMAGE_NAME##*,}
          TAG=${IMAGE_NAME##*:}
          echo "image=${IMAGE_NAME}" >> $GITHUB_OUTPUT
          echo "image_tag=${TAG}" >> $GITHUB_OUTPUT
      - name: Fix cache permissions
        if: ${{ inputs.xdg_cache_hash != '' }}
        run: |
          sudo chown -R $(id -u):$(id -g) "${XDG_CACHE_HOME}"
          sudo chmod -R ugo+rX "${XDG_CACHE_HOME}"