docker-build.yml

name: Docker Build

on:
  workflow_call:
    inputs:
      image:
        description: "Docker image (e.g. docker.io/<org>/<repo>)"
        type: string
        required: true
      checkout_ref:
        description: "Git ref (branch, SHA, or tag) to check out"
        type: string
        required: false
      file:
        description: "Path to Dockerfile relative to the repository root"
        type: string
        default: "Dockerfile"
      context:
        description: "Docker build context"
        type: string
        default: "."
      push:
        description: "Push image to registry"
        type: boolean
        default: false
      tag_with_version:
        description: "Also tag the image with version"
        type: boolean
        default: false
      version:
        description: "Version to tag when tag_with_version=true"
        type: string
        required: false
      experimental:
        description: "Build experimental image (main branch excluded)"
        type: boolean
        default: false

permissions:
  contents: read
  actions: write

jobs:
  # Build each platform natively on its own runner
  build-platform:
    name: Build ${{ matrix.platform }} Image
    runs-on: ${{ matrix.runner }}
    strategy:
      matrix:
        include:
          - platform: linux/amd64
            runner: blacksmith-2vcpu-ubuntu-2404
            arch: amd64
          - platform: linux/arm64
            runner: blacksmith-2vcpu-ubuntu-2404-arm
            arch: arm64
    outputs:
      digest-amd64: ${{ steps.export-digest.outputs.digest-amd64 }}
      digest-arm64: ${{ steps.export-digest.outputs.digest-arm64 }}
      image-name: ${{ steps.extract-name.outputs.name }}
    steps:
      - name: Extract Image Name
        id: extract-name
        run: |
          IMAGE="${{ inputs.image }}"
          NAME="${IMAGE##*/}"
          echo "name=$NAME" >> "$GITHUB_OUTPUT"

      - name: Checkout (specific ref)
        if: inputs.checkout_ref != ''
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.checkout_ref }}

      - name: Checkout (default)
        if: inputs.checkout_ref == ''
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: useblacksmith/setup-docker-builder@v1

      - name: Log in to Docker Hub
        if: inputs.push == true
        uses: docker/login-action@v3
        with:
          username: ${{ vars.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Build and Push Single-Platform Image
        id: build
        uses: useblacksmith/build-push-action@v2
        with:
          context: ${{ inputs.context }}
          file: ${{ inputs.file }}
          push: ${{ inputs.push }}
          platforms: ${{ matrix.platform }}
          provenance: false
          outputs: type=image,name=${{ inputs.image }},push-by-digest=true,name-canonical=true

      - name: Export Digest
        id: export-digest
        if: inputs.push == true
        run: |
          mkdir -p /tmp/digests
          digest="${{ steps.build.outputs.digest }}"
          echo "$digest" > "/tmp/digests/${{ matrix.arch }}.txt"
          echo "digest-${{ matrix.arch }}=$digest" >> "$GITHUB_OUTPUT"

      - name: Upload Digest
        if: inputs.push == true
        uses: actions/upload-artifact@v4
        with:
          name: digests-${{ steps.extract-name.outputs.name }}-${{ matrix.arch }}
          path: /tmp/digests/*
          if-no-files-found: error
          retention-days: 1

  # Create multi-arch manifest combining both platforms
  create-manifest:
    name: Create Multi-Arch Manifest
    needs: build-platform
    runs-on: blacksmith-2vcpu-ubuntu-2404
    if: inputs.push == true
    steps:
      - name: Extract Image Name
        id: extract-name
        run: |
          IMAGE="${{ inputs.image }}"
          NAME="${IMAGE##*/}"
          echo "name=$NAME" >> "$GITHUB_OUTPUT"

      - name: Download Digests
        uses: actions/download-artifact@v4
        with:
          path: /tmp/digests
          pattern: digests-${{ steps.extract-name.outputs.name }}-*
          merge-multiple: true

      - name: Set up Docker Buildx
        uses: useblacksmith/setup-docker-builder@v1

      - name: Log in to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ vars.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Checkout (specific ref)
        if: inputs.checkout_ref != ''
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.checkout_ref }}

      - name: Checkout (default)
        if: inputs.checkout_ref == ''
        uses: actions/checkout@v4

      - name: Create and Push Multi-Arch Manifest
        run: |
          IMAGE="${{ inputs.image }}"
          FULL_SHA=$(git rev-parse HEAD)

          # Prepare digest list for imagetools
          DIGEST_LIST=""
          for digest_file in /tmp/digests/*.txt; do
            digest=$(cat "$digest_file")
            DIGEST_LIST="${DIGEST_LIST} ${IMAGE}@${digest}"
          done

          if [ "${{ inputs.experimental }}" = "true" ]; then
            # Experimental mode: only tag with commithash-experimental
            docker buildx imagetools create -t "${IMAGE}:${FULL_SHA}-experimental" ${DIGEST_LIST}
          else
            # Standard mode: tag with latest and SHA
            docker buildx imagetools create -t "${IMAGE}:latest" ${DIGEST_LIST}
            docker buildx imagetools create -t "${IMAGE}:${FULL_SHA}" ${DIGEST_LIST}

            # Create manifest for version if needed
            if [ "${{ inputs.tag_with_version }}" = "true" ] && [ -n "${{ inputs.version }}" ]; then
              docker buildx imagetools create -t "${IMAGE}:v${{ inputs.version }}" ${DIGEST_LIST}
            fi
          fi

      - name: Output Image Information
        run: |
          IMAGE="${{ inputs.image }}"
          NAME="${IMAGE##*/}"
          FULL_SHA=$(git rev-parse HEAD)
          if [ "${{ inputs.experimental }}" = "true" ]; then
            TAGS="${FULL_SHA}-experimental"
            MODE="experimental"
          else
            TAGS="latest, ${FULL_SHA}"
            MODE="standard"
            if [ "${{ inputs.tag_with_version }}" = "true" ] && [ -n "${{ inputs.version }}" ]; then
              TAGS="${TAGS}, v${{ inputs.version }}"
            fi
          fi
          HUB_PATH=$(echo "${IMAGE}" | sed -E 's@^docker\.io/@@')
          echo "✅ Successfully built and pushed ${NAME} multi-arch image (${MODE} mode)"
          echo "🏷️ Tags: ${TAGS}"
          echo "🏗️ Platforms: linux/amd64, linux/arm64"
          echo "🔗 View at: https://hub.docker.com/r/${HUB_PATH}"