docker-smurf.yml

---
# Reusable Smurf SDKR workflow — build, scan, and push Docker images.
# Docs: docs/docker-smurf.md
name: 🐳 Smurf-Docker

on:
  workflow_call:
    inputs:
      # ── General toggles ──────────────────────────────────────────────
      docker_enable:
        description: Set to true to run docker commands
        type: string
        required: false
      docker_push:
        description: Set true for docker push
        type: string
        required: false
      provider:
        description: Cloud provider (aws, azure, gcp, digitalocean)
        type: string
        required: false
        default: aws

      # ── Docker image & build ─────────────────────────────────────────
      docker_image_name:
        description: Docker image name
        type: string
        required: false
      docker_image_tag:
        description: Docker image tag
        type: string
        default: 'latest'
      docker_image_tar:
        description: Docker image tar
        type: string
        required: false
        default: image
      docker_registry:
        description: 'The registry to Push Docker Image (aws, az, gcp, hub)'
        type: string
        default: aws
      docker_registry_url:
        description: 'The URL of the container registry (e.g., Docker Hub, ECR, GCR, ACR).'
        type: string
      dockerfile_path:
        description: Docker file path (relative to repo root)
        type: string
        default: Dockerfile
      docker_build_args:
        description: Docker Build Arguments
        type: string
        required: false
        default: key1=val1
      docker_build_platform:
        description: Docker Image Build Platform
        type: string
        default: linux/amd64
      docker_buildkit_enable:
        description: Set true to enable docker buildkit
        type: string
        required: false
        default: 'false'

      # ── AWS ──────────────────────────────────────────────────────────
      aws_region:
        required: false
        type: string
        description: AWS Region
        default: 'us-east-1'
      aws_assume_role:
        description: Set to True to run Assume another IAM Role step
        required: false
        type: string
        default: 'false'
      aws_assume_role_arn:
        type: string
        description: AWS assume role
        required: false

      # ── GCP ──────────────────────────────────────────────────────────
      gcp_project_id:
        required: false
        type: string
        description: 'ID of the default project to use for future API calls and invocations.'
      gcp_auth_method:
        description: GCP auth method to use like wip and json
        type: string
        required: false
      gcp_docker_push:
        description: Set to True to Push Images in GCP
        type: string
        required: false
        default: 'false'

    secrets:
      # ── AWS secrets ──────────────────────────────────────────────────
      AWS_ACCESS_KEY_ID:
        required: false
        description: AWS Access Key ID for direct authentication
      AWS_SECRET_ACCESS_KEY:
        required: false
        description: AWS Secret Access Key for direct authentication
      AWS_SESSION_TOKEN:
        required: false
        description: AWS Session Token for direct authentication
      BUILD_ROLE:
        required: false
        description: AWS OIDC role for aws authentication

      # ── GCP secrets ──────────────────────────────────────────────────
      GCP_WIP:
        required: false
        description: 'WIP Connected with Service Account'
      GCP_SERVICE_ACCOUNT:
        required: false
        description: 'GCP service account'
      GOOGLE_CREDENTIALS:
        required: false
        description: 'GCP service account JSON Key'
      GCP_SERVICE_ACCOUNT_KEY:
        required: false
        description: 'GCP service account JSON Key'

      # ── Docker Hub secrets ───────────────────────────────────────────
      DOCKER_USERNAME:
        required: false
        description: Docker Hub username
      DOCKER_PASSWORD:
        required: false
        description: Docker Hub access token or password

      aws_set_parameters:
        required: false
        description: Overriding the default values using --set flag

jobs:
  ###############################################
  # BUILD → SAVE → UPLOAD ARTIFACT
  ###############################################
  docker_build:
    if: inputs.docker_enable == 'true'
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
      - name: 📦 Checkout
        uses: actions/checkout@v6

      - name: ⚙️ Setup Smurf
        uses: clouddrove/smurf@v1.1.5

      - name: 🐳 Docker Image Build
        if: inputs.docker_buildkit_enable != 'true'
        run: |
          smurf sdkr build ${{ inputs.docker_image_name }}:${{ inputs.docker_image_tag }} \
            -f ${{ inputs.dockerfile_path }} \
            --platform ${{ inputs.docker_build_platform }} \
            --build-arg ${{ inputs.docker_build_args }}

      - name: 🐳 Docker Image Build with Buildkit
        if: inputs.docker_buildkit_enable == 'true'
        run: |
          smurf sdkr build ${{ inputs.docker_image_name }}:${{ inputs.docker_image_tag }} \
            -f ${{ inputs.dockerfile_path }} \
            --platform ${{ inputs.docker_build_platform }} \
            --build-arg ${{ inputs.docker_build_args }} \
            --buildkit

      - name: 💾 Save Docker Image as Artifact
        run: |
          docker save ${{ inputs.docker_image_name }}:${{ inputs.docker_image_tag }} \
            -o ${{ inputs.docker_image_tar }}

      - name: 📤 Upload Docker Image Artifact
        uses: actions/upload-artifact@v7
        with:
          name: docker-image
          path: ${{ inputs.docker_image_tar }}

  ###############################################
  # DOWNLOAD → AUTH → SCAN → TAG → PUSH
  ###############################################
  docker_scan_push:
    if: inputs.docker_enable == 'true' && inputs.docker_push == 'true'
    runs-on: ubuntu-latest
    needs: docker_build
    permissions:
      id-token: write
      contents: read
    steps:
      - name: 📦 Checkout
        uses: actions/checkout@v6

      - name: ⚙️ Setup Smurf
        uses: clouddrove/smurf@v1.1.5

      - name: 📥 Download Docker Image Artifact
        uses: actions/download-artifact@v8
        with:
          name: docker-image

      - name: 📂 Load Docker Image
        run: docker load -i ${{ inputs.docker_image_tar }}

      # ── Cloud authentication ─────────────────────────────────────────
      - name: 🟦 Install AWS CLI
        if: ${{ inputs.provider == 'aws' }}
        uses: aws-actions/configure-aws-credentials@v6
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }}
          role-to-assume: ${{ secrets.BUILD_ROLE }}
          aws-region: ${{ inputs.aws_region }}
          role-duration-seconds: 900
          role-skip-session-tagging: true

      - name: 🔑 Assume another IAM Role
        if: inputs.aws_assume_role == 'true'
        uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: ${{ inputs.aws_assume_role_arn }}
          aws-region: ${{ inputs.aws_region }}

      - name: ☁️ Authenticate Google Cloud with WIP and Service Account
        if: inputs.gcp_auth_method == 'wip'
        uses: google-github-actions/auth@v3
        with:
          token_format: access_token
          workload_identity_provider: ${{ secrets.GCP_WIP }}
          service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }}
          access_token_lifetime: 300s
          project_id: ${{ inputs.gcp_project_id }}

      - name: ☁️ Authenticate Google Cloud with Service Account JSON Key
        if: inputs.gcp_auth_method == 'json'
        uses: google-github-actions/auth@v3
        with:
          credentials_json: ${{ secrets.GOOGLE_CREDENTIALS }}

      - name: 🐋 Set Docker Hub environment variables
        if: inputs.docker_registry == 'hub'
        run: |
          echo "DOCKER_USERNAME=${{ secrets.DOCKER_USERNAME }}" >> $GITHUB_ENV
          echo "DOCKER_PASSWORD=${{ secrets.DOCKER_PASSWORD }}" >> $GITHUB_ENV
        shell: bash

      # ── Scan & push ──────────────────────────────────────────────────
      - name: 🛡️ Install Trivy
        run: |
          curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
          trivy --version

      - name: 🔍 Docker Image Scan
        run: |
          smurf sdkr scan ${{ inputs.docker_image_name }}:${{ inputs.docker_image_tag }}

      - name: 🏷️ Docker Image Tag
        if: inputs.docker_push == 'true'
        run: |
          smurf sdkr tag ${{ inputs.docker_image_name }}:${{ inputs.docker_image_tag }} \
            ${{ inputs.docker_registry_url }}/${{ inputs.docker_image_name }}:${{ inputs.docker_image_tag }}

      - name: 🚀 Docker Image Push
        if: inputs.docker_push == 'true' && inputs.gcp_docker_push != 'true'
        run: |
          smurf sdkr push ${{ inputs.docker_registry }} ${{ inputs.docker_registry_url }}/${{ inputs.docker_image_name }}:${{ inputs.docker_image_tag }}

      - name: 🚀 Docker Image Push on GCP
        if: inputs.docker_push == 'true' && inputs.gcp_docker_push == 'true'
        run: |
          smurf sdkr push ${{ inputs.docker_registry }} \
            ${{ inputs.docker_registry_url }}/${{ inputs.docker_image_name }}:${{ inputs.docker_image_tag }} \
            --project-id ${{ inputs.gcp_project_id }}