action.yml

name: 'Docker and GitOps Commit'
description: 'Build and push the Docker image and commits the new version to your GitOps repo.'
author: 'Staffbase SE'

inputs:
  docker-registry:
    description: 'Docker Registry'
    required: true
    default: 'registry.staffbase.com'
  docker-registry-api:
    description: 'Docker Registry API'
    required: false
    default: 'https://registry.staffbase.com/v2/'
  docker-image:
    description: 'Docker Image'
    required: true
  docker-custom-tag:
    description: 'Docker Custom Tag'
    required: false
  docker-username:
    description: 'Username for the Docker Registry'
    required: false
  docker-password:
    description: 'Password for the Docker Registry'
    required: false
  docker-file:
    description: 'Path of the Dockerfile. Should be relative to input.working-directory'
    required: true
    default: './Dockerfile'
  docker-build-args:
    description: "List of build-time variables"
    required: false
  docker-build-secrets:
    description: "List of secrets to expose to the build (e.g., key=string, GIT_AUTH_TOKEN=mytoken)"
    required: false
  docker-build-secret-files:
    description: "List of secret files to expose to the build (e.g., key=filename, MY_SECRET=./secret.txt)"
    required: false
  docker-build-target:
    description: "Sets the target stage to build"
    required: false
  docker-build-platforms:
    description: "Sets the target platforms for build"
    required: false
    default: 'linux/amd64'
  docker-build-provenance:
    description: "Generate provenance attestation for the build"
    required: false
    default: 'false'
  docker-build-outputs:
    description: "Custom output destinations (e.g., type=registry,push=true,compression=zstd,force-compression=true). When set, this replaces the default push behavior - include push=true if pushing is desired."
    required: false
  docker-disable-retagging:
    description: 'Disable retagging of existing images'
    required: false
    default: 'false'
  gitops-organization:
    description: 'GitHub Organization for GitOps'
    required: true
    default: 'Staffbase'
  gitops-repository:
    description: 'GitHub Repository for GitOps'
    required: true
    default: 'mops'
  gitops-user:
    description: 'GitHub User for GitOps'
    required: true
    default: 'Staffbot'
  gitops-email:
    description: 'GitHub User for GitOps'
    required: true
    default: 'staffbot@staffbase.com'
  gitops-token:
    description: 'GitHub Token for GitOps'
    required: false
  gitops-dev:
    description: 'Files which should be updated by the GitHub Action for DEV'
    required: false
  gitops-stage:
    description: 'Files which should be updated by the GitHub Action for STAGE'
    required: false
  gitops-prod:
    description: 'Files which should be updated by the GitHub Action for PROD'
    required: false
  upwind-client-id:
    description: 'Upwind Client ID'
    required: false
  upwind-organization-id:
    description: 'Upwind Organization ID'
    required: false
  upwind-client-secret:
    description: 'Upwind Client Secret'
    required: false
  working-directory:
    description: 'The path relative to the repo root dir in which the GitOps action should be executed.'
    required: false
    default: '.'

outputs:
  docker-tag:
    description: 'Docker tag'
    value: ${{ steps.preparation.outputs.tag }}
  docker-digest:
    description: 'Docker digest'
    value: ${{ steps.docker_build.outputs.digest || steps.docker_retag.outputs.digest }}

runs:
  using: "composite"
  steps:
    - name: Generate Tags
      id: preparation
      shell: bash
      env:
        INPUT_DOCKER_CUSTOM_TAG: ${{ inputs.docker-custom-tag }}
        INPUT_DOCKER_DISABLE_RETAGGING: ${{ inputs.docker-disable-retagging }}
        INPUT_DOCKER_REGISTRY: ${{ inputs.docker-registry }}
        INPUT_DOCKER_IMAGE: ${{ inputs.docker-image }}
      run: ${{ github.action_path }}/scripts/generate-tags.sh

    - name: Verify Architecture Match
      shell: bash
      if: steps.preparation.outputs.build == 'true'
      env:
        RUNNER_ARCH: ${{ runner.arch }}
        INPUT_DOCKER_BUILD_PLATFORMS: ${{ inputs.docker-build-platforms }}
      run: ${{ github.action_path }}/scripts/verify-architecture.sh

    - name: Set up Docker Buildx
      if: inputs.docker-username != '' && inputs.docker-password != ''
      uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

    - name: Login to Registry
      if: inputs.docker-username != '' && inputs.docker-password != ''
      uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
      with:
        registry: ${{ inputs.docker-registry }}
        username: ${{ inputs.docker-username }}
        password: ${{ inputs.docker-password }}

    - name: Build
      id: docker_build
      if: steps.preparation.outputs.build == 'true' && inputs.docker-username != '' && inputs.docker-password != ''
      uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
      with:
        context: ${{ inputs.working-directory }}
        push: ${{ inputs.docker-build-outputs == '' && steps.preparation.outputs.push || 'false' }}
        file: ${{ inputs.working-directory }}/${{ inputs.docker-file }}
        target: ${{ inputs.docker-build-target }}
        build-args: ${{ inputs.docker-build-args }}
        tags: ${{ steps.preparation.outputs.tag_list }}
        secrets: ${{ inputs.docker-build-secrets }}
        secret-files: ${{ inputs.docker-build-secret-files }}
        platforms: ${{ inputs.docker-build-platforms }}
        cache-from: type=gha
        cache-to: type=gha,mode=max
        provenance: ${{ inputs.docker-build-provenance }}
        outputs: ${{ inputs.docker-build-outputs }}

    - name: Retag Existing Image
      id: docker_retag
      if: steps.preparation.outputs.build == 'false'
      shell: bash
      env:
        INPUT_DOCKER_USERNAME: ${{ inputs.docker-username }}
        INPUT_DOCKER_PASSWORD: ${{ inputs.docker-password }}
        INPUT_DOCKER_REGISTRY_API: ${{ inputs.docker-registry-api }}
        INPUT_DOCKER_IMAGE: ${{ inputs.docker-image }}
        INPUT_TAG: ${{ steps.preparation.outputs.tag }}
        INPUT_LATEST: ${{ steps.preparation.outputs.latest }}
      run: ${{ github.action_path }}/scripts/retag-image.sh

    - name: Checkout GitOps Repository
      if: inputs.gitops-token != ''
      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      with:
        repository: ${{ inputs.gitops-organization }}/${{ inputs.gitops-repository }}
        token: ${{ inputs.gitops-token }}
        path: .github/${{ inputs.gitops-repository }}

    - name: Update Docker Image in Repository
      id: update_image
      if: inputs.gitops-token != ''
      working-directory: .github/${{ inputs.gitops-repository }}
      shell: bash
      env:
        INPUT_DOCKER_REGISTRY: ${{ inputs.docker-registry }}
        INPUT_DOCKER_IMAGE: ${{ inputs.docker-image }}
        INPUT_TAG: ${{ steps.preparation.outputs.tag }}
        INPUT_PUSH: ${{ steps.preparation.outputs.push }}
        INPUT_GITOPS_USER: ${{ inputs.gitops-user }}
        INPUT_GITOPS_EMAIL: ${{ inputs.gitops-email }}
        INPUT_GITOPS_TOKEN: ${{ inputs.gitops-token }}
        INPUT_GITOPS_ORGANIZATION: ${{ inputs.gitops-organization }}
        INPUT_GITOPS_REPOSITORY: ${{ inputs.gitops-repository }}
        INPUT_GITOPS_DEV: ${{ inputs.gitops-dev }}
        INPUT_GITOPS_STAGE: ${{ inputs.gitops-stage }}
        INPUT_GITOPS_PROD: ${{ inputs.gitops-prod }}
      run: ${{ github.action_path }}/scripts/update-gitops.sh

    - name: Emit Image Build Event to Upwind.io
      env:
        UPWIND_CLIENT_SECRET: ${{ inputs.upwind-client-secret }}
      if: "${{ inputs.upwind-client-id != '' && env.UPWIND_CLIENT_SECRET != '' && inputs.upwind-organization-id != '' }}"
      uses: upwindsecurity/create-image-build-event-action@3099fc1e1e002c6c2d7b7c635699944a708d260d # v3
      continue-on-error: true
      with:
        image: ${{ inputs.docker-image }}
        image_sha: ${{ steps.docker_build.outputs.digest || steps.docker_retag.outputs.digest }}
        upwind_client_id: ${{ inputs.upwind-client-id }}
        upwind_client_secret: ${{ env.UPWIND_CLIENT_SECRET }}
        upwind_organization_id: ${{ inputs.upwind-organization-id }}

branding:
  icon: 'git-merge'
  color: 'blue'