build-push-image.yaml

name: Build and Push image

on:
  workflow_call:
    inputs:
      file:
        required: true
        type: string
      flavor:
        type: string
      image:
        required: true
        type: string
      platforms:
        type: string
      push:
        required: true
        type: boolean
      ref:
        type: string
      tags:
        required: true
        type: string

permissions:
  contents: read # for actions/checkout to fetch code

jobs:
  build-push-image:
    runs-on: ubuntu-latest
    permissions:
      packages: write # for docker/build-push-action to push images
      id-token: write # for Cosign to be able to sign images with GHA token
    steps:
      - name: Checkout
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          ref: ${{ inputs.ref }}
      - name: Unshallow
        if: ${{ inputs.ref != '' }}
        run: |
          git fetch --prune --unshallow
          git fetch --tags -f
      - name: Set build-time flags
        run: |
          echo "LDFLAGS=$(make echo-ldflags)" >> $GITHUB_ENV
          echo "FLUX_VERSION=$(make echo-flux-version)" >> $GITHUB_ENV
      - uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
        id: meta
        with:
          images: ${{ inputs.image }}
          tags: ${{ inputs.tags }}
          flavor: ${{ inputs.flavor }}
      - name: setup qemu
        if: ${{ inputs.platforms != '' }}
        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
      - uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
      - uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
        id: build
        with:
          context: .
          platforms: ${{ inputs.platforms }}
          file: ${{ inputs.file }}
          build-args: |
            FLUX_VERSION=${{ env.FLUX_VERSION }}
            LDFLAGS=${{ env.LDFLAGS }}
            GIT_COMMIT=${{ github.sha }}
          push: ${{ inputs.push }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
      - name: Install cosign
        if: ${{ inputs.push }}
        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
      - name: Keyless signing of image
        if: ${{ inputs.push }}
        run: |
          cosign sign --yes ${{ inputs.image }}@${{ steps.build.outputs.digest }}
      - name: Verify the image signing
        if: ${{ inputs.push }}
        run: |
          cosign verify ${{ inputs.image }}@${{ steps.build.outputs.digest }} \
            --certificate-identity "https://github.com/${{ github.workflow_ref }}" \
            --certificate-oidc-issuer "https://token.actions.githubusercontent.com" | jq .