build-and-push.yml

# See `./docs/build-and-push.md` for usage details

name: Docker Build and Push

on:
  workflow_call:
    inputs:
      image_name:
        required: true
        type: string
      gar_name:
        required: true
        type: string
      project_id:
        required: true
        type: string
      docker_build_args:
        required: false
        default: ""
        type: string
      workload_identity_pool_project_number:
        required: false
        default: ${{ vars.GCPV2_WORKLOAD_IDENTITY_POOL_PROJECT_NUMBER }}
        type: string
      prebuild_script:
        type: string
        required: false
        default: |
          IMAGE_BUILD_CONTEXT_ABSPATH=$(realpath "$IMAGE_BUILD_CONTEXT")

          printf '{"commit":"%s","version":"%s","source":"%s","build":"%s"}\n' \
          "$GITHUB_SHA" \
          "$GITHUB_REF_NAME" \
          "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY" \
          "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" > "$IMAGE_BUILD_CONTEXT_ABSPATH/version.json"
      postbuild_script:
        type: string
        required: false
        default: ""
      image_build_context:
        required: false
        type: string
        default: "./"
      dockerfile_path:
        required: false
        type: string
        default: "./Dockerfile"
      image_tag_metadata:
        required: false
        type: string
      should_tag_ghcr:
        required: false
        type: boolean
        default: false
      should_tag_latest:
        required: false
        type: boolean
        default: false
      gar_location:
        required: false
        type: string
        default: "us"
      service_account_name:
        required: false
        type: string
        default: "artifact-writer"

jobs:
  build-and-push:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout Repository
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
        with:
          ref: ${{ (github.event_name == 'pull_request' && github.event.pull_request.head.sha) || github.ref }}
          persist-credentials: false
          fetch-tags: true
      - name: Run pre-build commands
        shell: bash
        env:
          IMAGE_BUILD_CONTEXT: ${{ inputs.image_build_context }}
          PREBUILD_SCRIPT: ${{ inputs.prebuild_script }}
        if: ${{ inputs.prebuild_script != '' }}
        run: |
          set -euo pipefail
          TMP="$RUNNER_TEMP/prebuild.sh"

          if [[ -f "$PREBUILD_SCRIPT" ]]; then
            chmod +x "$PREBUILD_SCRIPT"
            bash "$PREBUILD_SCRIPT"
          else
            printf '%s\n' "$PREBUILD_SCRIPT" > "$TMP"
            chmod +x "$TMP"
            bash "$TMP"
          fi
      - name: Build and Tag Container Image
        id: build
        uses: mozilla-it/deploy-actions/docker-build@a03a283ddeae43744c00f3fc86fbb997f65737ed
        with:
          image_name: ${{ inputs.image_name }}
          gar_name: ${{ inputs.gar_name }}
          project_id: ${{ inputs.project_id }}
          docker_build_args: ${{ inputs.docker_build_args }}
          image_build_context: ${{ inputs.image_build_context }}
          dockerfile_path: ${{ inputs.dockerfile_path }}
          image_tag_metadata: ${{ inputs.image_tag_metadata }}
          should_tag_ghcr: ${{ inputs.should_tag_ghcr }}
          should_tag_latest: ${{ inputs.should_tag_latest }}
          gar_location: ${{ inputs.gar_location }}
      - name: Download Wiz CLI
        env:
          # Wiz CLI release notes: https://docs.wiz.io/release-notes/wiz-cli
          WIZ_CLI_VERSION: 1.17.0
        run: curl -Lo wizcli "https://downloads.wiz.io/v1/wizcli/$WIZ_CLI_VERSION/wizcli-linux-amd64" && chmod +x wizcli
      - name: Run wiz-cli docker image scan
        env:
          IMAGE_TAGS: ${{ steps.build.outputs.image_tags }}
        run: |
          while IFS= read -r image_tag; do
            echo "Scanning image: ${image_tag}"
            ./wizcli docker scan \
              --image "${image_tag}" \
              --client-id "${{ secrets.WIZ_CLIENT_ID }}" \
              --client-secret "${{ secrets.WIZ_CLIENT_SECRET }}"
          done <<< "${IMAGE_TAGS}"
      - name: Run post-build commands
        shell: bash
        if: ${{ inputs.postbuild_script != '' }}
        env:
          POSTBUILD_SCRIPT: ${{ inputs.postbuild_script }}
        run: |
          set -euo pipefail
          TMP="$RUNNER_TEMP/postbuild.sh"

          if [[ -f "$POSTBUILD_SCRIPT" ]]; then
            chmod +x "$POSTBUILD_SCRIPT"
            bash "$POSTBUILD_SCRIPT"
          else
            printf '%s\n' "$POSTBUILD_SCRIPT" > "$TMP"
            chmod +x "$TMP"
            bash "$TMP"
          fi
      - name: Push Container Image
        uses: mozilla-it/deploy-actions/docker-push@6a12c3dac2fba1f9b66cd0ccbaafb5972093ddd9
        with:
          image_tags: ${{ steps.build.outputs.image_tags }}
          should_authenticate_to_ghcr: ${{ inputs.should_tag_ghcr }}
          project_id: ${{ inputs.project_id }}
          gar_location: ${{ inputs.gar_location }}
          workload_identity_pool_project_number: ${{ inputs.workload_identity_pool_project_number }}
          service_account_name: ${{ inputs.service_account_name }}