action-image-build.yaml

---
name: "Action: Image Build"

on:
  workflow_call:
    inputs:
      imagesToBuild:
        description: |-
          Pass a json string with the images and channels to build. e.g.:
            [
              {
                "app": "myapp",
                "channel": "main"
              },
              {
                "app": "myapp",
                "channel": "develop"
              }
            ]
        required: false
        type: string
        default: ''

      pushImages:
        required: false
        default: 'false'
        type: string

      sendNotification:
        required: false
        default: 'false'
        type: string

jobs:
  prepare:
    name: Prepare Matrices
    runs-on: ubuntu-latest
    outputs:
      matrices: ${{ steps.generate-matrices.outputs.matrices }}
    if: ${{ inputs.imagesToBuild != '' && inputs.imagesToBuild != '[]' }}
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
        with:
          fetch-depth: 1

      - name: Log images to build
        run: |
          echo 'imagesToBuild=${{ inputs.imagesToBuild }}'
          echo 'pushImages=${{ inputs.pushImages }}'
          echo 'sendNotification=${{ inputs.sendNotification }}'

      - name: Setup CUE
        uses: cue-lang/setup-cue@a93fa358375740cd8b0078f76355512b9208acb1

      - name: Validate Image Metadata
        shell: bash
        # 'xargs' rather than 'find -exec' so we can capture the status code
        run: |
          find ./ -name metadata.json | xargs -I {} cue vet --schema '#Spec' {} ./metadata.rules.cue

      - name: Generate Matrices
        id: generate-matrices
        run: |
          matrices=$(./.github/scripts/prepare-images.py '${{ inputs.imagesToBuild }}' '${{ inputs.pushImages }}')
          echo "matrices=${matrices}" >> $GITHUB_OUTPUT

  build-platform-images:
    name: Build/Test ${{ matrix.image.chan_image_name }} - ${{ matrix.image.platform }}
    runs-on: ubuntu-latest
    needs:
      - prepare
    strategy:
      matrix:
        image: ["${{ fromJson(needs.prepare.outputs.matrices).imagePlatformPermutations }}"]
      fail-fast: false
    steps:
      - name: Log Matrix Input
        run: |
          cat << EOF
          ${{ toJSON(matrix.image) }}
          EOF
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
        with:
          fetch-depth: 1

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Generate Token
        uses: actions/create-github-app-token@v1.11.0
        id: generate-token
        with:
          app-id: "${{ secrets.APP_ID }}"
          private-key: "${{ secrets.APP_PRIVATE_KEY }}"

      - name: Setup GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ steps.generate-token.outputs.token }}

      - name: Setup Tools
        shell: bash
        run: sudo apt-get install -y moreutils jo

      - name: Setup Goss
        if: ${{ matrix.image.chan_tests_enabled }}
        uses: e1himself/goss-installation-action@v1.2.1
        with:
          version: v0.3.21

      - name: Prepare Build Outputs
        id: prepare-build-outputs
        run: |
          if [[ ${{ inputs.pushImages }} == 'true' ]]; then
              image_name="ghcr.io/${{ github.repository_owner }}/${{ matrix.image.chan_image_name }}"
              outputs="type=image,name=${image_name},push-by-digest=true,name-canonical=true,push=true"
          else
              image_name="ghcr.io/${{ github.repository_owner }}/${{ matrix.image.chan_tag_testing }}"
              outputs="type=docker,name=${image_name},push=false"
          fi
          echo "image_name=${image_name}" >> $GITHUB_OUTPUT
          echo "outputs=${outputs}" >> $GITHUB_OUTPUT

      - name: Build Image
        uses: docker/build-push-action@v6
        id: build
        with:
          build-args: |-
            VERSION=${{ matrix.image.chan_upstream_version }}
            CHANNEL=${{ matrix.image.channel }}
          context: .
          platforms: ${{ matrix.image.platform }}
          file: ${{ matrix.image.chan_dockerfile }}
          outputs: ${{ steps.prepare-build-outputs.outputs.outputs }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Run Goss Tests
        id: dgoss
        if: ${{ matrix.image.chan_tests_enabled }}
        shell: bash
        env:
          CONTAINER_RUNTIME: docker
          GOSS_FILE: ${{ matrix.image.chan_goss_config }}
          GOSS_OPTS: --retry-timeout 60s --sleep 2s --color --format documentation
          GOSS_SLEEP: 2
          GOSS_FILES_STRATEGY: cp
          CONTAINER_LOG_OUTPUT: goss_container_log_output
        run: |
          if [[ '${{ inputs.pushImages }}' == 'true' ]]; then
              image_name="${{ steps.prepare-build-outputs.outputs.image_name }}@${{ steps.build.outputs.digest }}"
          else
              image_name="${{ steps.prepare-build-outputs.outputs.image_name }}"
          fi
          dgoss run ${image_name} ${{ matrix.image.chan_goss_args }}

      - name: Export Digest
        id: export-digest
        if: ${{ inputs.pushImages == 'true' }}
        run: |
          mkdir -p /tmp/${{ matrix.image.chan_image_name }}/digests
          digest="${{ steps.build.outputs.digest }}"
          echo "${{ matrix.image.platform }}" > "/tmp/${{ matrix.image.chan_image_name }}/digests/${digest#sha256:}"

      - name: Upload Digest
        if: ${{ inputs.pushImages == 'true' }}
        uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.image.chan_image_name }}
          path: /tmp/${{ matrix.image.chan_image_name }}/*
          if-no-files-found: error
          retention-days: 1

  merge:
    name: Merge ${{ matrix.manifest.image }}
    runs-on: ubuntu-latest
    needs:
      - prepare
      - build-platform-images
    # Always run merge, as the prior matrix is all or nothing. We test for prior step failure
    # in the "Test Failed Bit" step. This ensures if one app fails, others can still complete.
    if: ${{ always() && inputs.pushImages == 'true'}}
    strategy:
      matrix:
        manifest: ["${{ fromJSON(needs.prepare.outputs.matrices).manifestsToBuild }}"]
      fail-fast: false
    steps:
      - name: Download Digests
        uses: actions/download-artifact@v4
        with:
          name: ${{ matrix.manifest.image }}
          path: /tmp/${{ matrix.manifest.image }}

      - name: Ensure all platforms were built
        id: ensure-platforms
        run: |
            EXPECTED_COUNT=$(cat << EOF | jq ". | length"
            ${{ toJSON(matrix.manifest.platforms) }}
            EOF
            )
            ACTUAL_COUNT=$(ls -1 /tmp/${{ matrix.manifest.image }}/digests | wc -l)
            if [[ $EXPECTED_COUNT != $ACTUAL_COUNT ]]; then
                echo "Expected $EXPECTED_COUNT platforms, but only found $ACTUAL_COUNT"
                echo "Expected: ${{ toJSON(matrix.manifest.platforms) }}"
                echo "Actual: $(cat /tmp/${{ matrix.manifest.image }}/digests/*)"
                exit 1
            fi

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Generate Token
        uses: actions/create-github-app-token@v1.11.0
        id: generate-token
        with:
          app-id: "${{ secrets.APP_ID }}"
          private-key: "${{ secrets.APP_PRIVATE_KEY }}"

      - name: Setup GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ steps.generate-token.outputs.token }}

      - name: Log Files
        working-directory: /tmp/${{ matrix.manifest.image }}/digests
        run: |
          ls -la
          cat *

      # https://docs.docker.com/build/ci/github-actions/multi-platform/#distribute-build-across-multiple-runners
      - name: Merge Manifests
        id: merge
        working-directory: /tmp/${{ matrix.manifest.image }}/digests
        env:
          TAGS: ${{ toJSON(matrix.manifest.tags) }}
        run: |
          docker buildx imagetools create $(jq -cr '. | map("-t ghcr.io/${{ github.repository_owner }}/" + .) | join(" ")'  <<< "$TAGS") \
              $(printf 'ghcr.io/${{ github.repository_owner }}/${{ matrix.manifest.image }}@sha256:%s ' *)

      - name: Inspect image
        run: |
          docker buildx imagetools inspect ghcr.io/${{ github.repository_owner }}/${{ matrix.manifest.image }}:${{ matrix.manifest.version }}

      - name: Build successful
        id: build-success
        if: ${{ always() && steps.merge.outcome == 'success' && steps.failure-test.outcome == 'success' }}
        run: |-
          echo "message=🎉 ${{ matrix.manifest.app }}-${{ matrix.manifest.channel }} (${{ matrix.manifest.version }})" >> $GITHUB_OUTPUT
          echo "color=0x00FF00" >> $GITHUB_OUTPUT

      - name: Build failed
        id: build-failed
        if: ${{ always() && (steps.merge.outcome == 'failure' || steps.failure-test.outcome == 'failure') }}
        run: |-
          echo "message=💥 ${{ matrix.manifest.app }}-${{ matrix.manifest.channel }} (${{ matrix.manifest.version }})" >> $GITHUB_OUTPUT
          echo "color=0xFF0000" >> $GITHUB_OUTPUT

      # - name: Send Discord Webhook
      #   uses: sarisia/actions-status-discord@v1
      #   if: ${{ always() && inputs.sendNotification == 'true' }}
      #   with:
      #     webhook: ${{ secrets.DISCORD_WEBHOOK }}
      #     title: ${{ steps.build-failed.outputs.message || steps.build-success.outputs.message }}
      #     color: ${{ steps.build-failed.outputs.color || steps.build-success.outputs.color }}
      #     username: GitHub Actions

  # Summarize matrix https://github.community/t/status-check-for-a-matrix-jobs/127354/7
  build_success:
    name: Build matrix success
    runs-on: ubuntu-latest
    needs:
      - merge
    if: ${{ always() }}
    steps:
      - name: Check build matrix status
        if: ${{ (inputs.imagesToBuild != '' && inputs.imagesToBuild != '[]') && (needs.merge.result != 'success' && needs.merge.result != 'skipped') }}
        run: exit 1