ci: centralize Docker build workflows and improve reusability

Pdzly · Pdzly · commit 546532e7172b · 2025-12-26T20:28:46.000+01:00
- Introduced `docker-build.yml` reusable workflow to handle common Docker build and push tasks.
- Refactored `build-prod-images.yml` and `build-images.yml` to leverage the reusable workflow.
- Upgraded various GitHub Actions versions (e.g., actions/checkout, setup-python, setup-uv) for improved performance and compatibility.
- Added caching for UV dependencies in `test-backend.yml`.
- Simplified tag generation and metadata extraction processes.
diff --git a/.github/workflows/build-images.yml b/.github/workflows/build-images.yml
@@ -4,7 +4,7 @@ on:
   pull_request:
     branches:
       - master
-    types: [opened]
+    types: [opened, synchronize]
   workflow_dispatch:
 
 jobs:
@@ -20,7 +20,7 @@ jobs:
         uses: actions/checkout@v5
 
       - name: Get changes
-        uses: tj-actions/changed-files@90a06d6ba9543371ab4df8eeca0be07ca6054959
+        uses: tj-actions/changed-files@v45
         id: changed_files
         with:
           files_yaml: |
@@ -34,84 +34,26 @@ jobs:
 
       - name: Set lowercase repository variable
         id: lowercase_repo
+        env:
+          REPOSITORY: ${{ github.repository }}
         run: |
-          REPO_LC=$(echo "${{ github.repository }}" | tr '[:upper:]' '[:lower:]')
+          REPO_LC=$(echo "$REPOSITORY" | tr '[:upper:]' '[:lower:]')
           echo "REPO_LC=$REPO_LC" >> $GITHUB_OUTPUT
 
-  build-and-push-backend:
+  build-backend:
     needs: setup_build
-    runs-on: ubuntu-latest
-    environment: production
-    permissions:
-      packages: write
-      contents: read
-      attestations: write
-      id-token: write
     if: ${{ needs.setup_build.outputs.backend_changed == 'true' }}
+    uses: ./.github/workflows/docker-build.yml
+    with:
+      image_name: backend
+      context: backend
+      additional_tags: ghcr.io/${{ needs.setup_build.outputs.repo_lc }}-backend-preview:${{ github.event.pull_request.number || github.ref_name }}
 
-    steps:
-      - name: Checkout repo
-        uses: actions/checkout@v5
-
-      - name: Login to Github Container Registry
-        uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Extract metadata (tags, labels) for backend image
-        id: meta_backend
-        uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
-        with:
-          images: |
-            ghcr.io/${{ github.repository }}-backend
-
-      - name: Build and push Backend
-        uses: docker/build-push-action@3b5e8027fcad23fda98b2e3ac259d8d67585f671
-        with:
-          context: backend
-          push: true
-          tags: |
-            ${{ steps.meta_backend.outputs.tags }}
-            ghcr.io/${{ needs.setup_build.outputs.repo_lc }}-backend-preview:${{ github.event.pull_request.number || github.ref_name }}
-          labels: ${{ steps.meta_backend.outputs.labels }}
-
-  build-and-push-frontend:
+  build-frontend:
     needs: setup_build
-    runs-on: ubuntu-latest
-    environment: production
-    permissions:
-      packages: write
-      contents: read
-      attestations: write
-      id-token: write
     if: ${{ needs.setup_build.outputs.frontend_changed == 'true' }}
-
-    steps:
-      - name: Checkout repo
-        uses: actions/checkout@v5
-
-      - name: Login to Github Container Registry
-        uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Extract metadata (tags, labels) for frontend image
-        id: meta_frontend
-        uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
-        with:
-          images: |
-            ghcr.io/${{ github.repository }}-frontend
-
-      - name: Build and push Frontend
-        uses: docker/build-push-action@3b5e8027fcad23fda98b2e3ac259d8d67585f671
-        with:
-          context: frontend
-          push: true
-          tags: |
-            ${{ steps.meta_frontend.outputs.tags }}
-            ghcr.io/${{ needs.setup_build.outputs.repo_lc }}-frontend-preview:${{ github.event.pull_request.number || github.ref_name }}
-          labels: ${{ steps.meta_frontend.outputs.labels }}
+    uses: ./.github/workflows/docker-build.yml
+    with:
+      image_name: frontend
+      context: frontend
+      additional_tags: ghcr.io/${{ needs.setup_build.outputs.repo_lc }}-frontend-preview:${{ github.event.pull_request.number || github.ref_name }}
diff --git a/.github/workflows/build-prod-images.yml b/.github/workflows/build-prod-images.yml
@@ -14,103 +14,60 @@ on:
         type: boolean
 
 jobs:
-  build-and-push-backend:
+  setup:
     runs-on: ubuntu-latest
-    environment: production
-    permissions:
-      packages: write
-      contents: read
-      attestations: write
-      id-token: write
+    outputs:
+      repo_lc: ${{ steps.normalize.outputs.repo_lc }}
+      version: ${{ steps.normalize.outputs.version }}
+      backend_tags: ${{ steps.tags.outputs.backend }}
+      frontend_tags: ${{ steps.tags.outputs.frontend }}
 
     steps:
-      - name: Checkout repo
-        uses: actions/checkout@v5
-      - name: Normalize version
-        id: normalize_version
+      - name: Normalize inputs
+        id: normalize
+        env:
+          VERSION_INPUT: ${{ inputs.version }}
+          REPOSITORY: ${{ github.repository }}
         run: |
-          echo "normalized_version=$(echo '${{ github.event.inputs.version }}' | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9.]/-/g')" >> $GITHUB_OUTPUT
-          REPO_LC=$(echo "${{ github.repository }}" | tr '[:upper:]' '[:lower:]')
-          echo "REPO_LC=$REPO_LC" >> $GITHUB_OUTPUT
-      - name: Login to Github Container Registry
-        uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          VERSION=$(echo "$VERSION_INPUT" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9.]/-/g')
+          REPO_LC=$(echo "$REPOSITORY" | tr '[:upper:]' '[:lower:]')
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "repo_lc=$REPO_LC" >> $GITHUB_OUTPUT
 
-      - name: Extract metadata for backend image
-        id: meta_backend
-        uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
-        with:
-          images: |
-            ghcr.io/${{ steps.normalize_version.outputs.repo_lc  }}-backend
-      - name: Set latest tag
-        id: latest_tag
+      - name: Build tag strings
+        id: tags
+        env:
+          REPO_LC: ${{ steps.normalize.outputs.repo_lc }}
+          VERSION: ${{ steps.normalize.outputs.version }}
+          SET_LATEST: ${{ inputs.set_latest_tag }}
         run: |
-          if [[ "${{ github.event.inputs.set_latest_tag }}" == true ]]; then
-            echo "latest_tag=ghcr.io/${{ steps.normalize_version.outputs.repo_lc  }}-backend:latest" >> $GITHUB_OUTPUT
-          else
-            echo "latest_tag=" >> $GITHUB_OUTPUT
+          BACKEND_TAGS="ghcr.io/${REPO_LC}-backend:${VERSION}"
+          FRONTEND_TAGS="ghcr.io/${REPO_LC}-frontend:${VERSION}"
+          if [[ "$SET_LATEST" == "true" ]]; then
+            BACKEND_TAGS="${BACKEND_TAGS}
+          ghcr.io/${REPO_LC}-backend:latest"
+            FRONTEND_TAGS="${FRONTEND_TAGS}
+          ghcr.io/${REPO_LC}-frontend:latest"
           fi
-      - name: Build and push Backend
-        uses: docker/build-push-action@3b5e8027fcad23fda98b2e3ac259d8d67585f671
-        with:
-          context: backend
-          push: true
-          tags: |
-            ${{ steps.meta_backend.outputs.tags }}
-            ghcr.io/${{ steps.normalize_version.outputs.repo_lc  }}-backend:${{ steps.normalize_version.outputs.normalized_version }}
-            ${{ steps.latest_tag.outputs.latest_tag }}
-          labels: ${{ steps.meta_backend.outputs.labels }}
+          echo "backend<<EOF" >> $GITHUB_OUTPUT
+          echo "$BACKEND_TAGS" >> $GITHUB_OUTPUT
+          echo "EOF" >> $GITHUB_OUTPUT
+          echo "frontend<<EOF" >> $GITHUB_OUTPUT
+          echo "$FRONTEND_TAGS" >> $GITHUB_OUTPUT
+          echo "EOF" >> $GITHUB_OUTPUT
 
-  build-and-push-frontend:
-    runs-on: ubuntu-latest
-    environment: production
-    permissions:
-      packages: write
-      contents: read
-      attestations: write
-      id-token: write
-
-    steps:
-      - name: Checkout repo
-        uses: actions/checkout@v5
+  build-backend:
+    needs: setup
+    uses: ./.github/workflows/docker-build.yml
+    with:
+      image_name: backend
+      context: backend
+      additional_tags: ${{ needs.setup.outputs.backend_tags }}
 
-      - name: Normalize version
-        id: normalize_version
-        run: |
-          echo "normalized_version=$(echo '${{ github.event.inputs.version }}' | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9.]/-/g')" >> $GITHUB_OUTPUT
-          REPO_LC=$(echo "${{ github.repository }}" | tr '[:upper:]' '[:lower:]')
-          echo "REPO_LC=$REPO_LC" >> $GITHUB_OUTPUT
-      - name: Login to Github Container Registry
-        uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Extract metadata for frontend image
-        id: meta_frontend
-        uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
-        with:
-          images: |
-            ghcr.io/${{ steps.normalize_version.outputs.repo_lc  }}-frontend
-      - name: Set latest tag
-        id: latest_tag
-        run: |
-          if [[ "${{ github.event.inputs.set_latest_tag }}" == true ]]; then
-            echo "latest_tag=ghcr.io/${{ steps.normalize_version.outputs.repo_lc  }}-frontend:latest" >> $GITHUB_OUTPUT
-          else
-            echo "latest_tag=" >> $GITHUB_OUTPUT
-          fi
-      - name: Build and push Frontend
-        uses: docker/build-push-action@3b5e8027fcad23fda98b2e3ac259d8d67585f671
-        with:
-          context: frontend
-          push: true
-          tags: |
-            ${{ steps.meta_frontend.outputs.tags }}
-            ghcr.io/${{ steps.normalize_version.outputs.repo_lc  }}-frontend:${{ steps.normalize_version.outputs.normalized_version }}
-            ${{ steps.latest_tag.outputs.latest_tag }}
-          labels: ${{ steps.meta_frontend.outputs.labels }}
+  build-frontend:
+    needs: setup
+    uses: ./.github/workflows/docker-build.yml
+    with:
+      image_name: frontend
+      context: frontend
+      additional_tags: ${{ needs.setup.outputs.frontend_tags }}
diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml
@@ -0,0 +1,72 @@
+name: Reusable Docker Build
+
+on:
+  workflow_call:
+    inputs:
+      image_name:
+        description: 'Image name suffix (backend/frontend)'
+        required: true
+        type: string
+      context:
+        description: 'Docker build context path'
+        required: true
+        type: string
+      additional_tags:
+        description: 'Additional tags (newline-separated)'
+        required: false
+        type: string
+        default: ''
+      push:
+        description: 'Push image to registry'
+        required: false
+        type: boolean
+        default: true
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    environment: production
+    permissions:
+      packages: write
+      contents: read
+      attestations: write
+      id-token: write
+
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v5
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Normalize repository name
+        id: repo
+        env:
+          REPOSITORY: ${{ github.repository }}
+        run: |
+          echo "name=$(echo "$REPOSITORY" | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata (tags, labels)
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/${{ steps.repo.outputs.name }}-${{ inputs.image_name }}
+
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: ${{ inputs.context }}
+          push: ${{ inputs.push }}
+          tags: |
+            ${{ steps.meta.outputs.tags }}
+            ${{ inputs.additional_tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
diff --git a/.github/workflows/test-backend.yml b/.github/workflows/test-backend.yml
@@ -31,18 +31,25 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
           python-version: '3.13'
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@v5
         with:
           version: "0.5.16"
 
+      - name: Cache uv dependencies
+        uses: actions/cache@v4
+        with:
+          path: ~/.cache/uv
+          key: uv-${{ runner.os }}-${{ hashFiles('backend/uv.lock') }}
+          restore-keys: uv-${{ runner.os }}-
+
       - name: Install dependencies
         run: uv sync --extra test --extra migrations
 
@@ -53,4 +60,4 @@ jobs:
           APP_DEBUG: "true"
           APP_CORS_DOMAINS: '["http://test"]'
           APP_ALLOW_CORS_WILDCARD: "false"
-        run: uv run pytest
+        run: uv run pytest
