feat!: token input for shared actions #2
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: 'Multi-runner container image build' | ||
| on: | ||
| workflow_call: | ||
| inputs: | ||
| image: | ||
| description: 'Name of the image' | ||
| type: string | ||
| required: true | ||
| context: | ||
| description: 'Path to build context' | ||
| type: string | ||
| required: true | ||
| dockerfile: | ||
| description: 'Path to Dockerfile' | ||
| type: string | ||
| required: true | ||
| tag-suffix: | ||
| description: 'Suffix to append to the image tag' | ||
| type: string | ||
| default: '' | ||
| dockerhub-push: | ||
| description: 'Push to Docker Hub' | ||
| type: boolean | ||
| default: false | ||
| build-args: | ||
| description: 'Docker build arguments' | ||
| type: string | ||
| required: false | ||
| platforms: | ||
| description: 'Platforms to build for' | ||
| type: string | ||
| runner-mapping: | ||
| description: 'Mapping from platforms to runners' | ||
| type: string | ||
| target: | ||
| description: 'Sets the target stage to build' | ||
| type: string | ||
| release-tag-type: | ||
| description: 'The type of release tag to use, either git-tag or semver' | ||
| type: string | ||
| default: 'semver' | ||
| secrets: | ||
| GITHUB_APP_TOKEN: | ||
| required: | ||
| DOCKERHUB_USERNAME: | ||
| required: false | ||
| DOCKERHUB_TOKEN: | ||
| required: false | ||
| env: | ||
| GHCR_IMAGE: ghcr.io/${{ github.repository_owner }}/${{ inputs.image }} | ||
| DOCKERHUB_IMAGE: altran1502/${{ inputs.image }} | ||
| jobs: | ||
| matrix: | ||
| name: 'Generate matrix' | ||
| runs-on: ubuntu-latest | ||
| outputs: | ||
| matrix: ${{ steps.matrix.outputs.matrix }} | ||
| key: ${{ steps.artifact-key.outputs.base }} | ||
| steps: | ||
| - name: Generate build matrix | ||
| id: matrix | ||
| shell: bash | ||
| env: | ||
| PLATFORMS: ${{ inputs.platforms || 'linux/amd64,linux/arm64' }} | ||
| RUNNER_MAPPING: ${{ inputs.runner-mapping || '{"linux/amd64":"ubuntu-latest","linux/arm64":"ubuntu-24.04-arm"}' }} | ||
| run: | | ||
| matrix=$(jq -R -c \ | ||
| --argjson runner_mapping "${RUNNER_MAPPING}" \ | ||
| 'split(",") | map({platform: ., runner: $runner_mapping[.]})' \ | ||
| <<< "${PLATFORMS}") | ||
| echo "matrix=${matrix}" | tee -a $GITHUB_OUTPUT | ||
| - name: Determine artifact key | ||
| id: artifact-key | ||
| shell: bash | ||
| env: | ||
| IMAGE: ${{ inputs.image }} | ||
| SUFFIX: ${{ inputs.tag-suffix }} | ||
| run: | | ||
| base="${IMAGE}${SUFFIX}-digests" | ||
| echo "base=${base}" | tee -a $GITHUB_OUTPUT | ||
| build: | ||
| needs: matrix | ||
| runs-on: ${{ matrix.runner }} | ||
| strategy: | ||
| fail-fast: false | ||
| matrix: | ||
| include: ${{ fromJson(needs.matrix.outputs.matrix) }} | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0 | ||
| with: | ||
| persist-credentials: false | ||
| token: ${{ secrets.GITHUB_APP_TOKEN }} | ||
| - uses: immich-app/devtools/actions/image-build@7d95e52a7a597ce005a306d6891467fc15427b69 # image-build-action-0.1.1 | ||
| with: | ||
| context: ${{ inputs.context }} | ||
| dockerfile: ${{ inputs.dockerfile }} | ||
| image: ${{ env.GHCR_IMAGE }} | ||
| ghcr-token: ${{ secrets.GITHUB_APP_TOKEN }} | ||
| platform: ${{ matrix.platform }} | ||
| artifact-key-base: ${{ needs.matrix.outputs.key }} | ||
| build-args: ${{ inputs.build-args }} | ||
| target: ${{ inputs.target }} | ||
| merge: | ||
| needs: [matrix, build] | ||
| runs-on: ubuntu-latest | ||
| if: ${{ !github.event.pull_request.head.repo.fork }} | ||
| steps: | ||
| - name: Download digests | ||
| uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 | ||
| with: | ||
| path: ${{ runner.temp }}/digests | ||
| pattern: ${{ needs.matrix.outputs.key }}-* | ||
| merge-multiple: true | ||
| github-token: ${{ secrets.GITHUB_APP_TOKEN }} | ||
| - name: Login to Docker Hub | ||
| if: ${{ inputs.dockerhub-push }} | ||
| uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0 | ||
| with: | ||
| username: ${{ secrets.DOCKERHUB_USERNAME }} | ||
| password: ${{ secrets.DOCKERHUB_TOKEN }} | ||
| - name: Login to GHCR | ||
| uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0 | ||
| with: | ||
| registry: ghcr.io | ||
| username: ${{ github.repository_owner }} | ||
| password: ${{ secrets.GITHUB_APP_TOKEN }} | ||
| - name: Set up Docker Buildx | ||
| uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1 | ||
| - name: Generate docker image tags | ||
| id: meta | ||
| uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0 | ||
| env: | ||
| DOCKER_METADATA_PR_HEAD_SHA: 'true' | ||
| with: | ||
| flavor: | | ||
| # Disable latest tag | ||
| latest=false | ||
| suffix=${{ inputs.tag-suffix }} | ||
| images: | | ||
| name=${{ env.GHCR_IMAGE }} | ||
| name=${{ env.DOCKERHUB_IMAGE }},enable=${{ inputs.dockerhub-push }} | ||
| tags: | | ||
| # Tag with branch name | ||
| type=ref,event=branch | ||
| # Tag with pr-number | ||
| type=ref,event=pr | ||
| # Tag with long commit sha hash | ||
| type=sha,format=long,prefix=commit- | ||
| # Release version tags | ||
| type=semver,pattern=v{{version}},enabled=${{ inputs.release-tag-type == 'semver' }} | ||
| type=semver,pattern=v{{major}},enabled=${{ inputs.release-tag-type == 'semver' }} | ||
| type=ref,event=tag,enabled=${{ inputs.release-tag-type == 'git-tag' }} | ||
| type=raw,value=release,enable=${{ github.event_name == 'release' }} | ||
| - name: Create manifest list and push | ||
| working-directory: ${{ runner.temp }}/digests | ||
| run: | | ||
| # Process annotations | ||
| declare -a ANNOTATIONS=() | ||
| if [[ -n "$DOCKER_METADATA_OUTPUT_JSON" ]]; then | ||
| while IFS= read -r annotation; do | ||
| # Extract key and value by removing the manifest: prefix | ||
| if [[ "$annotation" =~ ^manifest:(.+)=(.+)$ ]]; then | ||
| key="${BASH_REMATCH[1]}" | ||
| value="${BASH_REMATCH[2]}" | ||
| # Use array to properly handle arguments with spaces | ||
| ANNOTATIONS+=(--annotation "index:$key=$value") | ||
| fi | ||
| done < <(jq -r '.annotations[]' <<< "$DOCKER_METADATA_OUTPUT_JSON") | ||
| fi | ||
| TAGS=$(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \ | ||
| SOURCE_ARGS=$(printf "${GHCR_IMAGE}@sha256:%s " *) | ||
| docker buildx imagetools create $TAGS "${ANNOTATIONS[@]}" $SOURCE_ARGS | ||
