release-docker.yml

---
name: Build and push Docker image
on:
  workflow_call:
    inputs:
      tag:
        type: string
        description: The tag to use for the Docker image.
        required: true
jobs:
  build-push-image:
    name: Build and Push Docker Image
    runs-on: ubuntu-22.04-oz-8core
    environment: release
    env:
      DOCKERHUB_IMAGE: openzeppelin/openzeppelin-relayer
      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
      SLACK_CHANNEL: '#oss-releases'
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d  # v2.16.1
        with:
          egress-policy: audit
      - name: Slack notification
        uses: act10ns/slack@d96404edccc6d6467fc7f8134a420c851b1e9054  # v2.2.0
        with:
          status: starting
          steps: ${{ toJson(steps) }}
          channel: ${{ env.SLACK_CHANNEL }}
          message: Starting docker build and push to dockerhub for ${{ github.repository }} with tag ${{ inputs.tag }}......
        if: always()
      - name: Checkout release branch
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          ref: ${{ inputs.tag }}
      - name: Docker meta
        id: meta
        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf  # v6.0.0
        with:
          # list of Docker images to use as base name for tags
          images: ${{ env.DOCKERHUB_IMAGE }}
          # generate Docker tags based on the following events/attributes
          tags: |
            type=semver,value=${{ inputs.tag }},pattern={{version}}
            type=sha,value=${{ github.event.inputs.commit }}
            type=raw,value=${{ inputs.tag }}
            type=raw,value=latest
          labels: |
            org.opencontainers.image.created={{commit_date 'YYYY-MM-DDTHH:mm:ss.SSS[Z]'}}
            org.opencontainers.image.title=openzeppelin-relayer
            org.opencontainers.image.vendor=openzeppelin
            org.opencontainers.image.description="OpenZeppelin Relayer service provides infrastructure to relay transactions to the EVM and Non-EVM networks."
        env:
          DOCKER_METADATA_SHORT_SHA_LENGTH: 10
      - name: Login to Dockerhub
        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121
        with:
          username: ${{ vars.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_PAT }}
      - name: Set Up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd  # v4.0.0
      - name: Build Docker image
        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294  # v7.0.0
        id: build
        with:
          context: .
          push: true
          file: ./Dockerfile.production
          platforms: linux/amd64,linux/arm64
          cache-from: type=gha
          cache-to: type=gha,mode=max
          provenance: mode=max
          sbom: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
      - name: Get github app token
        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859  # v3.0.0
        id: gh-app-token
        with:
          app-id: ${{ vars.GH_APP_ID }}
          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
      - name: Attest
        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32  # v4.1.0
        id: attest
        with:
          subject-name: docker.io/${{ env.DOCKERHUB_IMAGE }}
          subject-digest: ${{ steps.build.outputs.digest }}
          push-to-registry: false
          github-token: ${{ steps.gh-app-token.outputs.token }}
      - name: Docker Hub Description
        uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa  # v5.0.0
        with:
          username: ${{ vars.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_PAT }}
          repository: ${{ env.DOCKERHUB_IMAGE }}
          short-description: ${{ github.event.repository.description }}
          readme-filepath: ./DOCKER_README.md
      - name: Slack notification success or failure
        uses: act10ns/slack@d96404edccc6d6467fc7f8134a420c851b1e9054  # v2.2.0
        with:
          status: ${{ job.status }}
          steps: ${{ toJson(steps) }}
          channel: ${{ env.SLACK_CHANNEL }}
          message: Push to Dockerhub ${{ job.status }}!
        if: always()
      - name: Print image digest to summary
        run: |-
          echo "Image tags: ${{ steps.meta.outputs.tags }}" >> "${GITHUB_STEP_SUMMARY}"
          echo "Image labels: ${{ steps.meta.outputs.labels }}" >> "${GITHUB_STEP_SUMMARY}"