fluxer/.github/workflows/_build-image.yaml

# SPDX-License-Identifier: AGPL-3.0-or-later
name: build image (reusable)

on:
  workflow_call:
    inputs:
      image:
        description: "Image name under ghcr.io/<owner>/ (for example fluxer-api)"
        type: string
        required: true
      dockerfile:
        description: "Path to the Dockerfile to build"
        type: string
        required: true
      context:
        description: "Docker build context"
        type: string
        required: false
        default: "."
      build-version:
        description: "Explicit Fluxer CalVer build version (YYYY.MDD.MICRO, UTC HHMMSS without leading zeroes) to use instead of automatic UTC clock allocation"
        type: string
        required: false
        default: ""
      moving-tags:
        description: "Comma-separated moving tags to repoint at this build"
        type: string
        required: false
        default: "v1,latest"
      extra-build-args:
        description: "Additional Docker build args, one KEY=VALUE entry per line"
        type: string
        required: false
        default: ""

permissions:
  actions: read
  contents: read
  packages: write

defaults:
  run:
    shell: bash

env:
  GHCR_OWNER: ${{ github.repository_owner }}

jobs:
  meta:
    name: resolve metadata
    runs-on: ubuntu-24.04
    environment: builds
    timeout-minutes: 5
    outputs:
      build_version: ${{ steps.vars.outputs.build_version }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: Set up Rust toolchain (CI helpers)
        uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b
        with:
          toolchain: "1.93.0"
      - name: set variables
        id: vars
        env:
          GH_TOKEN: ${{ github.token }}
          FLUXER_BUILD_VERSION: ${{ inputs.build-version }}
        run: >-
          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- resolve-calver
          --github-output

  build:
    name: build ${{ matrix.platform }}
    needs: meta
    runs-on: ${{ matrix.runner }}
    environment: builds
    timeout-minutes: 75
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: amd64
            runner: blacksmith-4vcpu-ubuntu-2404
          - platform: arm64
            runner: blacksmith-4vcpu-ubuntu-2404-arm
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8
        with:
          context: ${{ inputs.context }}
          file: ${{ inputs.dockerfile }}
          push: true
          provenance: false
          platforms: linux/${{ matrix.platform }}
          tags: ghcr.io/${{ env.GHCR_OWNER }}/${{ inputs.image }}:${{ needs.meta.outputs.build_version }}-${{ matrix.platform }}
          build-args: |
            BUILD_VERSION=${{ needs.meta.outputs.build_version }}
            ${{ inputs.extra-build-args }}
          cache-from: type=gha,scope=${{ inputs.image }}-${{ matrix.platform }}
          cache-to: type=gha,scope=${{ inputs.image }}-${{ matrix.platform }},mode=max,ignore-error=true
        env:
          DOCKER_BUILD_SUMMARY: false
          DOCKER_BUILD_RECORD_UPLOAD: false

  merge:
    name: merge multi-arch manifest
    needs: [meta, build]
    runs-on: ubuntu-24.04
    environment: builds
    timeout-minutes: 10
    steps:
      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: create and push multi-arch manifest
        env:
          IMAGE: ghcr.io/${{ env.GHCR_OWNER }}/${{ inputs.image }}
          VERSION: ${{ needs.meta.outputs.build_version }}
          MOVING_TAGS: ${{ inputs.moving-tags }}
        run: |
          set -euo pipefail
          tag_args=( "-t" "${IMAGE}:${VERSION}" )
          IFS=',' read -ra moving <<< "${MOVING_TAGS}"
          for raw in "${moving[@]}"; do
            t="$(echo "$raw" | xargs)"
            [ -n "$t" ] && tag_args+=( "-t" "${IMAGE}:${t}" )
          done
          docker buildx imagetools create "${tag_args[@]}" \
            "${IMAGE}:${VERSION}-amd64" \
            "${IMAGE}:${VERSION}-arm64"
          docker buildx imagetools inspect "${IMAGE}:${VERSION}"