reusable-docker.yml

name: Reusable workflow - Docker

on:
  workflow_call:
    inputs:
      FOLDER:
        required: true
        type: string
      DOCKERFILE_NAME:
        required: false
        type: string
        default: 'Dockerfile'
      REGISTRY:
        required: true
        type: string
      IMAGE_NAME:
        required: true
        type: string
      IMAGE_TAG:
        required: false
        type: string
        default: 'latest'
    secrets:
      GHCR_USER:
        required: true
      GHCR_TOKEN:
        required: true

jobs:
  # ============================================================================
  # BUILD
  # ============================================================================
  build:
    name: build
    runs-on: ubuntu-22.04

    permissions:
      contents: read
      pull-requests: write
      id-token: write

    outputs:
      digest: ${{ steps.build-and-push-step.outputs.digest }}

    steps:
      - name: 📂 Checkout repository
        uses: actions/checkout@v4.1.1

      # ========================================================================
      # Install Tooling
      # ========================================================================
      # Setup docker build
      - name: 🔻 Setup Docker buildx
        uses: docker/setup-buildx-action@v3

      # ========================================================================
      # Authenticate to GHCR
      # ========================================================================
      - name: 🎫 Login to GitHub Container Registry
        uses: docker/login-action@v3
        id: login
        with:
          registry: ghcr.io
          username: ${{ secrets.GHCR_USER }}
          # Create a PAT with `write:packages` scopes and save it as an Actions secret `GHCR_TOKEN`
          password: ${{ secrets.GHCR_TOKEN }}

      # ========================================================================
      # Build locally and run Trivy (only in PR)
      # ========================================================================
      - name: 🚧 Build locally
        if: github.event_name == 'pull_request'
        id: build_local
        uses: docker/build-push-action@master
        with:
          push: false
          file: ${{ inputs.FOLDER }}/${{ inputs.DOCKERFILE_NAME }}
          tags: ${{ inputs.IMAGE_NAME }}:${{ inputs.IMAGE_TAG }}
          # Needed for trivy
          outputs: type=docker

      - name: 🛡 Run Trivy vulnerability scanner
        if: github.event_name == 'pull_request'
        id: docker_trivy
        uses: aquasecurity/trivy-action@0.28.0
        continue-on-error: true
        with:
          image-ref: ${{ inputs.IMAGE_NAME }}:${{ inputs.IMAGE_TAG }}
          format: 'table'
          # WARN ONLY
          exit-code: '0'
          ignore-unfixed: true
          severity: 'CRITICAL,HIGH'

      # ========================================================================
      # PR Output (only in PR)
      # ========================================================================
      - name: 📄 Show Build Output
        if: github.event_name == 'pull_request'
        uses: actions/github-script@v7
        env:
          BUILD: ${{ steps.build_local.outputs.metadata }}
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const output = `#### Image: 📋 \`${{ inputs.IMAGE_NAME }}\`

            |     | Step        | Result                                       |
            | --- | ----------  | -------------------------------------------- |
            | 📖  | **Build**   | \`${{ steps.build_local.outcome }}\`               |
            | 🛡  | **Trivy**   | \`${{ steps.docker_trivy.outcome }}\`               |

            ### Build:

            <details>
            <summary>Build output</summary>

            \`\`\`${process.env.BUILD}
            \`\`\`

            </details>

            ---

            *Pusher: @${{ github.actor }}, Action: \`${{ github.event_name }}\`*`;

            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: output
            })

      # ========================================================================
      # Build Image and push to GHCR (except on PR)
      # ========================================================================
      # Extract metadata (tags, labels) for Docker
      - name: 📭 Extract Docker metadata
        if: github.event_name != 'pull_request'
        id: meta
        uses: docker/metadata-action@v5.5.1
        with:
          images: ${{ inputs.REGISTRY }}/${{ inputs.IMAGE_NAME }}

      # Build and push container image with Buildx (don't push on PR)
      - name: 🔨 Build and push container image
        if: github.ref == 'refs/heads/main' && github.event_name != 'pull_request'
        id: build-and-push-step
        uses: docker/build-push-action@master
        with:
          push: ${{ github.event_name != 'pull_request' }}
          file: ${{ inputs.FOLDER }}/${{ inputs.DOCKERFILE_NAME }}
          labels: ${{ steps.meta.outputs.labels }}
          # Use tags: ${{ steps.meta.outputs.tags }} if you want to tag the image with branch name
          tags: ${{ inputs.REGISTRY }}/${{ inputs.IMAGE_NAME }}:${{ inputs.IMAGE_TAG }}