template-python/.github/workflows/_build_container.yml at main · markurtz/template-python · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
---
# ─────────────────────────────────────────────────────────────────────────────
# _build_container.yml
#
# Builds container images for the project. This workflow handles only the
# build step. It returns the image name and tag, allowing calling workflows
# to handle pushing, publishing, or vulnerability scanning.
#
# Inputs:
#   build_type (required): "release", "post", "nightly", or "dev"
#   push       (optional): Whether to push the image to GHCR (default: false)
#
# Outputs:
#   image_name — The name of the built container image
#   image_tag  — The tag of the built container image
#
# Callers: development.yml, nightly.yml, release.yml
# ─────────────────────────────────────────────────────────────────────────────
name: "Build Container (Reusable)"
on:
  workflow_call:
    inputs:
      build_type:
        description: "Type of build: release, post, nightly, or dev"
        required: true
        type: string
      push:
        description: "Whether to push the built container image to GHCR"
        required: false
        type: boolean
        default: false
    outputs:
      image_name:
        description: "The name of the built container image"
        value: ${{ jobs.build-container.outputs.image_name }}
      image_tag:
        description: "The tag of the built container image"
        value: ${{ jobs.build-container.outputs.image_tag }}
permissions:
  contents: read
  packages: write  # To push to GHCR
jobs:
  build-container:
    name: "Build Container (${{ inputs.build_type }})"
    runs-on: ubuntu-latest
    outputs:
      image_name: ${{ steps.build.outputs.image_name }}
      image_tag: ${{ steps.build.outputs.image_tag }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2  # v3
      - name: Log in to GitHub Container Registry
        if: ${{ inputs.push }}
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567  # v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Build and push container
        uses: docker/build-push-action@2cdde99a3119bfeb512642f4c2201b17b620eeff  # v5
        with:
          context: .
          push: ${{ inputs.push }}
          load: ${{ !inputs.push }}
          tags: ghcr.io/${{ github.repository }}:${{ inputs.build_type }}-${{ github.sha }},ghcr.io/${{
            github.repository }}:latest
          cache-from: type=gha
          cache-to: type=gha,mode=max
      - name: Export outputs
        id: build
        run: |-
          echo "image_name=ghcr.io/${{ github.repository }}" >> "$GITHUB_OUTPUT"
          echo "image_tag=${{ inputs.build_type }}-${{ github.sha }}" >> "$GITHUB_OUTPUT"