docker_dockerhub_release_callable.yml

---
name: Build & Push Docker Image

# Only builds the image if a release was created.
# This guarantees the commit is tagged and on main branch.
# (see https://docs.github.com/en/repositories/releasing-projects-on-github/about-releases)

# USE_WORKFLOW
## yamllint disable-line rule:truthy
on:
  workflow_call:
    inputs:
      image-name:
        type: string
        required: true
        description: "Name of the image. Usually it is sensible to set this to the repository name"
      push:
        type: boolean
        required: false
        description: "Flag to enable the workflow to actually push the built image to the registry"
        default: false
      upload-security-scan-results:
        type: boolean
        required: false
        description: "Upload results of trivy scan of docker image to Github Security page"
        default: false
# /USE_WORKFLOW
# USE_REPOSITORY
## yamllint disable-line rule:truthy
#on: release
# /USE_REPOSITORY

jobs:
  docker-build-push:
    runs-on: ubuntu-latest
    env:
      # hard-coded organization prefix here in order to push images
      IMAGE_NAME: hlag/${{ inputs.image-name }}
    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Configure Tags
        uses: docker/metadata-action@369eb591f429131d6889c46b94e711f089e6ca96 # v5.6.1
        id: meta
        with:
          images: ${{ env.IMAGE_NAME }}
          tags: |
            type=ref,event=pr
            type=edge,enable={{is_default_branch}}
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
            type=sha
      - name: Set up QEMU
        uses: docker/setup-qemu-action@53851d14592bedcffcf25ea515637cff71ef929a # v3.3.0
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@6524bf65af31da8d45b59e8c27de4bd072b392f5 # v3.8.0
      - name: Login to DockerHub Container Registry
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Build Image
        uses: docker/build-push-action@b32b51a8eda65d6793cd0494a773d4f6bcef32dc # v6.11.0
        with:
          context: .
          load: true
          tags: ${{ env.IMAGE_NAME }}:trivy-scan
          cache-from: type=gha
          cache-to: type=gha,mode=max
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@18f2510ee396bbf400402947b394f2dd8c87dbb0 # 0.29.0
        with:
          image-ref: ${{ env.IMAGE_NAME }}:trivy-scan
          format: "sarif"
          output: "trivy-results.sarif"
      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@48ab28a6f5dbc2a99bf1e0131198dd8f1df78169 # v3.28.0
        if: ${{ inputs.upload-security-scan-results }}
        with:
          sarif_file: "trivy-results.sarif"
      - name: Build and push image
        uses: docker/build-push-action@b32b51a8eda65d6793cd0494a773d4f6bcef32dc # v6.11.0
        with:
          context: .
          push: ${{ inputs.push }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max