build-container-reuse.yaml

name: Build Container Image

on:
  workflow_call:
    inputs:
      container_name:
        required: true
        type: string
        description: 'Name of the container to build'
      dockerfile_path:
        required: false
        type: string
        default: 'Dockerfile'
        description: 'Path to Dockerfile relative to container directory'
      build_args:
        required: false
        type: string
        default: ''
        description: 'Build arguments as key=value pairs'
      target:
        required: false
        type: string
        default: ''
        description: 'Build target stage'
      latest_name:
        required: false
        type: string
        default: 'latest'
        description: 'Tag name to use for latest (e.g., "latest" or "2025.2")'
      context_path:
        required: false
        type: string
        default: '{{ defaultContext }}'
        description: 'Path to docker context'
      prebuild_script:
        required: false
        type: string
        description: 'path to shell script to run before building the containers'
      prebuild_script_working_dir:
        type: string
        default: "."
        description: 'directory which the prebuild_script will run'

jobs:
  build:
    if: github.event_name != 'pull_request' || (github.event_name == 'pull_request' && github.event.action != 'closed')
    runs-on: ubuntu-latest

    permissions:
      contents: read
      packages: write

    steps:
      - name: setup docker buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4

      - name: login to ghcr.io
        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: image metadata
        id: meta
        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6
        with:
          images: ghcr.io/${{ github.repository }}/${{ inputs.container_name }}
          tags: |
            type=raw,value=${{ inputs.latest_name }},enable={{is_default_branch}}
            type=raw,value=${{ inputs.latest_name }},enable=${{ github.event_name == 'workflow_dispatch' }}
            type=ref,event=tag
            type=ref,event=pr
        env:
          # Create the annotations at the index as well since this
          # defaults to manifest only and we have to manually merge
          # the container is multi-arch because of provenance creating
          # an 'unknown/unknown' arch with data. We've got no annotations
          # that are arch specific so populate them at the index as well.
          DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,index

      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
      - name: Run prebuild script
        if: ${{ inputs.prebuild_script != '' }}
        run: "${{ inputs.prebuild_script }}"
        working-directory: ${{ inputs.prebuild_script_working_dir }}

      - name: build and push container image
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7
        with:
          file: ${{ inputs.dockerfile_path }}
          build-args: ${{ inputs.build_args }}
          context: ${{ inputs.context_path }}
          pull: true
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          annotations: ${{ steps.meta.outputs.annotations }}
          target: ${{ inputs.target }}

  clean:
    if: github.event_name == 'pull_request' && github.event.action == 'closed'
    runs-on: ubuntu-latest

    permissions:
      packages: write

    steps:
      - name: clean up PR container
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
        env:
          CONTAINER_NAME: '${{ inputs.container_name }}'
        with:
          script: |
            const container_name = `${context.repo.repo}/${process.env.CONTAINER_NAME}`;
            const response = await github.rest.packages.getAllPackageVersionsForPackageOwnedByOrg({
              package_type: "container",
              package_name: container_name,
              org: context.repo.owner,
            });

            const target_tag = `pr-${context.payload.pull_request.number}`;
            console.log(`Looking for tag ${target_tag} for container ${container_name}`);

            const versions = response.data || [];
            const matchingVersion = versions.find(version =>
              version.metadata.container.tags.includes(target_tag)
            );

            if (matchingVersion) {
              console.log(`Found tag to delete "${target_tag}":`, matchingVersion.html_url);
              await github.rest.packages.deletePackageVersionForOrg({
                package_type: "container",
                package_name: container_name,
                org: context.repo.owner,
                package_version_id: matchingVersion.id,
              });
              console.log("Tag deleted");
            } else {
              console.log(`No package version found with the tag "${target_tag}".`);
            }