feat: extend container reusables (7 build inputs + tolerate-pull-failure)

[CybotTM]

Summary

Two atomic commits, both unblock the Phase 2 caller migration in netresearch/snipe-it-docker-compose-stack#11 (build.yml + security.yml currently cannot delegate to these reusables because of input gaps).

Commit 1 — build-container.yml: +7 inputs

Input	Type	Purpose
target	string	Multi-stage build target (snipe-it: runtime)
build-args	string (multi-line)	Newline-separated KEY=VALUE for Dockerfile ARGs
cache-scope	string	GHA cache scope name — parallel matrix cells stay separate
provenance	string	Buildx provenance mode (snipe-it: mode=max)
sbom	boolean	In-image SBOM (default false, backward compat)
metadata-tags	string (multi-line)	Override metadata-action's tags: for bespoke fan-out
metadata-labels	string (multi-line)	OCI labels appended to auto-generated set

Backward compatible: every new input has a safe default that preserves current behavior.

The metadata-action's default 5 tag patterns are now computed in a shell step gated on metadata-tags == '', then passed as a step output. Keeps the YAML expression-syntax simple without losing flexibility.

Commit 2 — security-container.yml: +tolerate-pull-failure

Boolean input. When true, the Trivy step gets continue-on-error: true. Use case: caller fans a matrix over tags where some images may not exist (rolling-variants blocked by composer audit). Job-level continue-on-error: on a reusable-caller is forbidden by GitHub, so only step-level (inside the reusable) works.

Off by default → no behavioral change for existing callers.

Caller migration sketch (snipe-it Phase 2 follow-up)

jobs:
  build:
    uses: netresearch/.github/.github/workflows/build-container.yml@main
    permissions:
      contents: read
      packages: write
      security-events: write
      id-token: write
      attestations: write
    with:
      image-name: snipe-it-php-fpm
      ref: ${{ steps.ref.outputs.ref }}
      target: runtime
      build-args: |
        SNIPE_IT_VERSION=${{ steps.ref.outputs.ref }}
        BUILD_DATE=${{ steps.ref.outputs.build_date }}
        VCS_REF=${{ github.sha }}
        ROLLING_DEPS=${{ matrix.composer == 'rolling' }}
      provenance: mode=max
      sbom: true
      cache-scope: ${{ matrix.track.name }}-${{ matrix.composer }}
      metadata-tags: ${{ steps.tags.outputs.tags }}
      attest: true
      sign: true

  security:
    uses: netresearch/.github/.github/workflows/security-container.yml@main
    permissions:
      contents: read
      security-events: write
      packages: read
    with:
      image-ref: ghcr.io/.../snipe-it-php-fpm:${{ matrix.tag }}
      tolerate-pull-failure: ${{ matrix.composer == 'rolling' }}

Verification

• actionlint clean on both modified files
• All new inputs default to backward-compatible values
• Signed commits + DCO + conventional-commit prefix

After this lands

• snipe-it-docker-compose-stack#11 can absorb the build.yml + security.yml migration as a follow-up commit. Realistic line-count for build.yml: ~301 → ~150 (matrix + ref-resolution + per-cell tag computation stay in the caller).

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[Copilot]

Pull request overview

This PR extends the repository’s reusable container workflows to support more advanced caller use cases (multi-stage targets, build args, cache scoping, custom metadata tags/labels) and to optionally tolerate Trivy pull failures in post-build security scans—unblocking downstream workflow migrations that currently can’t delegate due to input gaps.

Changes:

• Added 7 new inputs to build-container.yml and wired them through to docker/metadata-action and docker/build-push-action (including overrideable metadata tags and cache scoping).
• Added tolerate-pull-failure to security-container.yml to optionally set continue-on-error on the Trivy step.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
.github/workflows/build-container.yml	Adds new reusable inputs for build customization (target, build args, cache scope, provenance/SBOM, and metadata overrides) and computes default metadata tag patterns when not overridden.
.github/workflows/security-container.yml	Adds an input to optionally tolerate Trivy step failures by enabling step-level continue-on-error.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud