wc-build-push-test.yml

---
name: Build, Push & Test

on:
  workflow_call:
    inputs:
      acceptance-test-devcontainer-file:
        description: Path to the devcontainer.json file to use for acceptance tests.
        required: false
        type: string
      acceptance-test-path:
        description: Path to the Playwright acceptance tests (directory that contains playwright.config.ts).
        required: false
        type: string
      build-args:
        description: Optional docker build args (newline-separated KEY=VALUE).
        required: false
        type: string
      build-test-runner-labels:
        description: >-
          JSON array used to select multi-architecture runners for build and test jobs.
          Must be valid JSON.

          Examples:
            '["ubuntu-latest"]'
            '["ubuntu-latest", "ubuntu-24.04-arm"]'
            '[["self-hosted", "linux", "x86_64"], ["self-hosted", "linux", "arm64"]]'
        required: false
        type: string
        default: '["ubuntu-latest", "ubuntu-24.04-arm"]'
      devcontainer-metadata-file:
        description: >-
          Path to a JSON file containing devcontainer metadata to add as a label to the built image.

          Examples:
            '.devcontainer/devcontainer-metadata.json'
            '.devcontainer/<flavor>/devcontainer-metadata.json'
        required: false
        type: string
      dockerfile:
        description: Path to the Dockerfile to build
        required: true
        type: string
      enable-edge-tag:
        description: Whether to also build and push an "edge" tag for the image.
        required: false
        type: boolean
        default: false
      image-name:
        description: >-
          Name of the Docker image to build, without registry or tag.

          Examples:
            'my-image'
            'my-org/my-image'
        required: true
        type: string
      integration-test-file:
        description: Path to the BATS test file to run for integration tests.
        required: false
        type: string
      integration-test-podman:
        description: Enable running the tests using the Podman container runtime, next to the default Docker container runtime.
        required: false
        type: boolean
        default: false
      registry:
        description: >-
          Docker registry to push built containers to.
          `DOCKER_REGISTRY_USERNAME` and `DOCKER_REGISTRY_PASSWORD` secrets must be set if not using GitHub Container Registry (ghcr.io).
        required: false
        type: string
        default: "ghcr.io"
      runner-labels:
        description: >-
          JSON array used to select the default linux runner for non-build jobs.
          Must be valid JSON.

          Examples:
            '["ubuntu-latest"]'
            '["self-hosted", "linux", "x86_64"]'
        required: false
        type: string
        default: '["ubuntu-latest"]'
    outputs:
      digest:
        value: ${{ jobs.build-push.outputs.digest }}
      fully-qualified-image-name:
        value: ${{ jobs.build-push.outputs.fully-qualified-image-name }}
      image-basename:
        value: ${{ jobs.build-push.outputs.image-basename }}
      version:
        value: ${{ jobs.build-push.outputs.version }}
    secrets:
      DOCKER_REGISTRY_PASSWORD:
        description: Password or token for Docker login, if not provided the GitHub token will be used.
        required: false
      DOCKER_REGISTRY_USERNAME:
        description: User name for Docker login, if not provided the GitHub actor will be used.
        required: false
      TEST_GITHUB_PASSWORD:
        required: false
      TEST_GITHUB_TOKEN:
        required: false
      TEST_GITHUB_TOTP_SECRET:
        required: false
      TEST_GITHUB_USER:
        required: false

permissions: {}

jobs:
  build-push:
    name: 🛠️
    uses: ./.github/workflows/wc-build-push.yml
    permissions:
      actions: read # is needed by anchore/sbom-action to find workflow artifacts when attaching release assets
      artifact-metadata: write # is needed by actions/attest-build-provenance to write artifact metadata
      attestations: write # is needed by actions/attest-build-provenance to push attestations
      contents: write # is needed by anchore/sbom-action for artifact uploads
      id-token: write # is needed by actions/attest-build-provenance to obtain an OIDC token
      packages: write # is needed to push image manifest when using GitHub Container Registry
      pull-requests: write # is needed by marocchino/sticky-pull-request-comment to post comments
    secrets: &docker-secrets
      DOCKER_REGISTRY_USERNAME: ${{ secrets.DOCKER_REGISTRY_USERNAME }}
      DOCKER_REGISTRY_PASSWORD: ${{ secrets.DOCKER_REGISTRY_PASSWORD }}
    with:
      build-args: ${{ inputs.build-args }}
      dockerfile: ${{ inputs.dockerfile }}
      enable-edge-tag: ${{ inputs.enable-edge-tag }}
      registry: ${{ inputs.registry }}
      image-name: ${{ inputs.image-name }}
      devcontainer-metadata-file: ${{ inputs.devcontainer-metadata-file }}
      runner-labels: ${{ inputs.runner-labels }}
      build-test-runner-labels: ${{ inputs.build-test-runner-labels }}

  integration-test-docker:
    name: 🧪
    if: ${{ inputs.integration-test-file }}
    needs: build-push
    uses: ./.github/workflows/wc-integration-test-docker.yml
    permissions:
      contents: read
    secrets: *docker-secrets
    with: &integration-test-inputs
      build-test-runner-labels: ${{ inputs.build-test-runner-labels }}
      fully-qualified-image-name: ${{ needs.build-push.outputs.fully-qualified-image-name }}
      image-basename: ${{ needs.build-push.outputs.image-basename }}
      image-digest: ${{ needs.build-push.outputs.digest }}
      registry: ${{ inputs.registry }}
      test-file: ${{ inputs.integration-test-file }}

  integration-test-podman:
    name: 🧪
    if: ${{ inputs.integration-test-file && inputs.integration-test-podman }}
    needs: build-push
    uses: ./.github/workflows/wc-integration-test-podman.yml
    permissions:
      contents: read
    secrets: *docker-secrets
    with: *integration-test-inputs

  acceptance-test:
    name: 🏗️
    if: ${{ inputs.acceptance-test-devcontainer-file && inputs.acceptance-test-path }}
    needs: build-push
    uses: ./.github/workflows/wc-acceptance-test.yml
    permissions:
      contents: read
    secrets:
      TEST_GITHUB_TOKEN: ${{ secrets.TEST_GITHUB_TOKEN }}
      TEST_GITHUB_USER: ${{ secrets.TEST_GITHUB_USER }}
      TEST_GITHUB_PASSWORD: ${{ secrets.TEST_GITHUB_PASSWORD }}
      TEST_GITHUB_TOTP_SECRET: ${{ secrets.TEST_GITHUB_TOTP_SECRET }}
    with:
      image-basename: ${{ needs.build-push.outputs.image-basename }}
      devcontainer-file: ${{ inputs.acceptance-test-devcontainer-file }}
      acceptance-test-path: ${{ inputs.acceptance-test-path }}