action.yml

name: 'Docker and GitOps Commit'
description: 'Build and push the Docker image and commits the new version to your GitOps repo.'
author: 'Staffbase SE'

inputs:
  docker-registry:
    description: 'Docker Registry'
    required: true
    default: 'registry.staffbase.com'
  docker-registry-api:
    description: 'Docker Registry API'
    required: false
    default: 'https://registry.staffbase.com/v2/'
  docker-image:
    description: 'Docker Image'
    required: true
  docker-custom-tag:
    description: 'Docker Custom Tag'
    required: false
  docker-tag-timestamp:
    description: 'Insert a UTC timestamp into dev/main/master branch tags (e.g. dev-20260602143055-<short-sha>) to make them sortable for Flux image automation. Enabled by default; set to ''false'' for the legacy <prefix>-<short-sha> format.'
    required: false
    default: 'true'
  docker-tag-keep-v-prefix:
    description: 'Keep the leading "v" on release (v*) tags (v1.2.3 -> v1.2.3). Opt-in; defaults to stripping it (v1.2.3 -> 1.2.3).'
    required: false
    default: 'false'
  docker-username:
    description: 'Username for the Docker Registry'
    required: false
  docker-password:
    description: 'Password for the Docker Registry'
    required: false
  docker-file:
    description: 'Path of the Dockerfile. Should be relative to input.working-directory'
    required: true
    default: './Dockerfile'
  docker-build-args:
    description: "List of build-time variables"
    required: false
  docker-build-secrets:
    description: "List of secrets to expose to the build (e.g., key=string, GIT_AUTH_TOKEN=mytoken)"
    required: false
  docker-build-secret-files:
    description: "List of secret files to expose to the build (e.g., key=filename, MY_SECRET=./secret.txt)"
    required: false
  docker-build-target:
    description: "Sets the target stage to build"
    required: false
  docker-build-platforms:
    description: "Sets the target platforms for build"
    required: false
    default: 'linux/amd64'
  docker-build-provenance:
    description: "Generate provenance attestation for the build"
    required: false
    default: 'false'
  docker-build-outputs:
    description: "Custom output destinations (e.g., type=registry,push=true,compression=zstd,force-compression=true). When set, this replaces the default push behavior - include push=true if pushing is desired."
    required: false
  multiarch-mode:
    description: "Multi-arch build mode. Empty (default) keeps the single-arch behaviour. 'build' builds only the runner's native platform and pushes it by digest — run it once per architecture in a job matrix. 'merge' combines those digests into one multi-arch image, applies the tags and runs the GitOps/Upwind steps. See README 'Multi-Arch Images'."
    required: false
    default: ''
  multiarch-artifact-name:
    description: "Base name of the artifact carrying the per-architecture digests between the build and merge jobs. The architecture is appended (e.g. docker-digests-arm64). Only needs changing when a workflow builds more than one image."
    required: false
    default: 'docker-digests'
  multiarch-digests-path:
    description: 'Directory holding the per-architecture digest files.'
    required: false
    default: '/tmp/gitops-action-digests'
  docker-disable-retagging:
    description: 'Disable retagging of existing images'
    required: false
    default: 'false'
  deployment-annotations:
    description: 'Stamp deployment-tracking annotations (deploy.staffbase.com/repositoryFullName, /commitSha, /version) onto the updated GitOps manifests. Enabled by default; set to ''false'' to skip.'
    required: false
    default: 'true'
  deployment-domain:
    description: 'Domain used as the key namespace for deployment-tracking metadata. Applied verbatim to GitOps annotation keys (<domain>/repositoryFullName) and reversed to reverse-DNS for image label keys (deploy.staffbase.com -> com.staffbase.deploy.repositoryFullName).'
    required: false
    default: 'deploy.staffbase.com'
  deployment-labels:
    description: 'Stamp deployment-tracking labels (repositoryFullName, commitSha, version) onto the built Docker image. Enabled by default; only applied on builds, not on release/custom retags. Set to ''false'' to skip.'
    required: false
    default: 'true'
  gitops-organization:
    description: 'GitHub Organization for GitOps'
    required: true
    default: 'Staffbase'
  gitops-repository:
    description: 'GitHub Repository for GitOps'
    required: true
    default: 'mops'
  gitops-user:
    description: 'GitHub User for GitOps'
    required: true
    default: 'Staffbot'
  gitops-email:
    description: 'GitHub User for GitOps'
    required: true
    default: 'staffbot@staffbase.com'
  gitops-token:
    description: 'GitHub Token for GitOps'
    required: false
  gitops-dev:
    description: 'Files which should be updated by the GitHub Action for DEV'
    required: false
  gitops-stage:
    description: 'Files which should be updated by the GitHub Action for STAGE'
    required: false
  gitops-prod:
    description: 'Files which should be updated by the GitHub Action for PROD'
    required: false
  upwind-client-id:
    description: 'Upwind Client ID'
    required: false
  upwind-organization-id:
    description: 'Upwind Organization ID'
    required: false
  upwind-client-secret:
    description: 'Upwind Client Secret'
    required: false
  working-directory:
    description: 'The path relative to the repo root dir in which the GitOps action should be executed.'
    required: false
    default: '.'

outputs:
  docker-tag:
    description: 'Docker tag'
    value: ${{ steps.preparation.outputs.tag }}
  docker-digest:
    description: 'Docker digest'
    value: ${{ steps.docker_merge.outputs.digest || steps.docker_build.outputs.digest || steps.docker_retag.outputs.digest }}

runs:
  using: "composite"
  steps:
    - name: Generate Tags
      id: preparation
      shell: bash
      env:
        INPUT_DOCKER_CUSTOM_TAG: ${{ inputs.docker-custom-tag }}
        INPUT_DOCKER_TAG_TIMESTAMP: ${{ inputs.docker-tag-timestamp }}
        INPUT_DOCKER_TAG_KEEP_V_PREFIX: ${{ inputs.docker-tag-keep-v-prefix }}
        INPUT_DOCKER_DISABLE_RETAGGING: ${{ inputs.docker-disable-retagging }}
        INPUT_DOCKER_REGISTRY: ${{ inputs.docker-registry }}
        INPUT_DOCKER_IMAGE: ${{ inputs.docker-image }}
      run: ${{ github.action_path }}/scripts/generate-tags.sh

    - name: Generate Deployment Label Prefix
      id: deployment_labels
      shell: bash
      env:
        INPUT_DEPLOYMENT_DOMAIN: ${{ inputs.deployment-domain }}
      run: ${{ github.action_path }}/scripts/generate-label-prefix.sh

    - name: Resolve Build Configuration
      id: build_config
      shell: bash
      if: steps.preparation.outputs.build == 'true' && inputs.multiarch-mode != 'merge'
      env:
        RUNNER_ARCH: ${{ runner.arch }}
        INPUT_MULTIARCH_MODE: ${{ inputs.multiarch-mode }}
        INPUT_DOCKER_BUILD_PLATFORMS: ${{ inputs.docker-build-platforms }}
        INPUT_DOCKER_BUILD_OUTPUTS: ${{ inputs.docker-build-outputs }}
        INPUT_DOCKER_REGISTRY: ${{ inputs.docker-registry }}
        INPUT_DOCKER_IMAGE: ${{ inputs.docker-image }}
        INPUT_TAG_LIST: ${{ steps.preparation.outputs.tag_list }}
        INPUT_PUSH: ${{ steps.preparation.outputs.push }}
      run: ${{ github.action_path }}/scripts/resolve-build-config.sh

    - name: Verify Architecture Match
      shell: bash
      if: steps.preparation.outputs.build == 'true' && inputs.multiarch-mode != 'merge'
      env:
        RUNNER_ARCH: ${{ runner.arch }}
        INPUT_DOCKER_BUILD_PLATFORMS: ${{ steps.build_config.outputs.platforms }}
      run: ${{ github.action_path }}/scripts/verify-architecture.sh

    - name: Set up Docker Buildx
      if: inputs.docker-username != '' && inputs.docker-password != ''
      uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0

    - name: Login to Registry
      if: inputs.docker-username != '' && inputs.docker-password != ''
      uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
      with:
        registry: ${{ inputs.docker-registry }}
        username: ${{ inputs.docker-username }}
        password: ${{ inputs.docker-password }}

    - name: Build
      id: docker_build
      if: steps.preparation.outputs.build == 'true' && inputs.multiarch-mode != 'merge' && inputs.docker-username != '' && inputs.docker-password != ''
      uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
      with:
        context: ${{ inputs.working-directory }}
        push: ${{ steps.build_config.outputs.build_outputs == '' && steps.preparation.outputs.push || 'false' }}
        file: ${{ inputs.working-directory }}/${{ inputs.docker-file }}
        target: ${{ inputs.docker-build-target }}
        build-args: ${{ inputs.docker-build-args }}
        tags: ${{ steps.build_config.outputs.tags }}
        labels: |
          ${{ inputs.deployment-labels == 'true' && format('{0}.repositoryFullName={1}', steps.deployment_labels.outputs.label_prefix, github.repository) || '' }}
          ${{ inputs.deployment-labels == 'true' && format('{0}.commitSha={1}', steps.deployment_labels.outputs.label_prefix, github.sha) || '' }}
          ${{ inputs.deployment-labels == 'true' && format('{0}.version={1}', steps.deployment_labels.outputs.label_prefix, steps.preparation.outputs.gitops_tag) || '' }}
        secrets: ${{ inputs.docker-build-secrets }}
        secret-files: ${{ inputs.docker-build-secret-files }}
        platforms: ${{ steps.build_config.outputs.platforms }}
        cache-from: type=gha${{ steps.build_config.outputs.cache_suffix }}
        cache-to: type=gha,mode=max${{ steps.build_config.outputs.cache_suffix }}
        provenance: ${{ inputs.docker-build-provenance }}
        outputs: ${{ steps.build_config.outputs.build_outputs }}

    - name: Export Digest
      if: inputs.multiarch-mode == 'build' && steps.docker_build.outputs.digest != ''
      shell: bash
      env:
        DIGEST: ${{ steps.docker_build.outputs.digest }}
        DIGESTS_PATH: ${{ inputs.multiarch-digests-path }}
      run: |
        set -euo pipefail
        mkdir -p "$DIGESTS_PATH"
        touch "${DIGESTS_PATH}/${DIGEST#sha256:}"

    - name: Upload Digest
      if: inputs.multiarch-mode == 'build' && steps.docker_build.outputs.digest != ''
      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
      with:
        name: ${{ inputs.multiarch-artifact-name }}-${{ steps.build_config.outputs.arch }}
        path: ${{ inputs.multiarch-digests-path }}/*
        if-no-files-found: error
        retention-days: 1

    - name: Download Digests
      if: inputs.multiarch-mode == 'merge' && steps.preparation.outputs.build == 'true' && steps.preparation.outputs.push == 'true'
      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
      with:
        path: ${{ inputs.multiarch-digests-path }}
        pattern: ${{ inputs.multiarch-artifact-name }}-*
        merge-multiple: true

    - name: Merge Multi-Arch Manifest
      id: docker_merge
      if: inputs.multiarch-mode == 'merge' && steps.preparation.outputs.build == 'true' && steps.preparation.outputs.push == 'true'
      shell: bash
      env:
        INPUT_DOCKER_REGISTRY: ${{ inputs.docker-registry }}
        INPUT_DOCKER_IMAGE: ${{ inputs.docker-image }}
        INPUT_TAG_LIST: ${{ steps.preparation.outputs.tag_list }}
        INPUT_DIGESTS_PATH: ${{ inputs.multiarch-digests-path }}
      run: ${{ github.action_path }}/scripts/merge-manifests.sh

    - name: Retag Existing Image
      id: docker_retag
      if: steps.preparation.outputs.build == 'false' && inputs.multiarch-mode != 'build'
      shell: bash
      env:
        INPUT_DOCKER_USERNAME: ${{ inputs.docker-username }}
        INPUT_DOCKER_PASSWORD: ${{ inputs.docker-password }}
        INPUT_DOCKER_REGISTRY_API: ${{ inputs.docker-registry-api }}
        INPUT_DOCKER_IMAGE: ${{ inputs.docker-image }}
        INPUT_TAG: ${{ steps.preparation.outputs.tag }}
        INPUT_LATEST: ${{ steps.preparation.outputs.latest }}
      run: ${{ github.action_path }}/scripts/retag-image.sh

    - name: Checkout GitOps Repository
      if: inputs.gitops-token != '' && inputs.multiarch-mode != 'build'
      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        repository: ${{ inputs.gitops-organization }}/${{ inputs.gitops-repository }}
        token: ${{ inputs.gitops-token }}
        path: .github/${{ inputs.gitops-repository }}

    - name: Update Docker Image in Repository
      id: update_image
      if: inputs.gitops-token != '' && inputs.multiarch-mode != 'build'
      working-directory: .github/${{ inputs.gitops-repository }}
      shell: bash
      env:
        INPUT_DOCKER_REGISTRY: ${{ inputs.docker-registry }}
        INPUT_DOCKER_IMAGE: ${{ inputs.docker-image }}
        INPUT_TAG: ${{ steps.preparation.outputs.gitops_tag }}
        INPUT_PUSH: ${{ steps.preparation.outputs.push }}
        INPUT_GITOPS_USER: ${{ inputs.gitops-user }}
        INPUT_GITOPS_EMAIL: ${{ inputs.gitops-email }}
        INPUT_GITOPS_TOKEN: ${{ inputs.gitops-token }}
        INPUT_GITOPS_ORGANIZATION: ${{ inputs.gitops-organization }}
        INPUT_GITOPS_REPOSITORY: ${{ inputs.gitops-repository }}
        INPUT_GITOPS_DEV: ${{ inputs.gitops-dev }}
        INPUT_GITOPS_STAGE: ${{ inputs.gitops-stage }}
        INPUT_GITOPS_PROD: ${{ inputs.gitops-prod }}
        INPUT_DEPLOYMENT_ANNOTATIONS: ${{ inputs.deployment-annotations }}
        INPUT_DEPLOYMENT_DOMAIN: ${{ inputs.deployment-domain }}
      run: ${{ github.action_path }}/scripts/update-gitops.sh

    - name: Emit Image Build Event to Upwind.io
      env:
        UPWIND_CLIENT_SECRET: ${{ inputs.upwind-client-secret }}
      if: "${{ inputs.upwind-client-id != '' && env.UPWIND_CLIENT_SECRET != '' && inputs.upwind-organization-id != '' && inputs.multiarch-mode != 'build' }}"
      uses: upwindsecurity/create-image-build-event-action@3099fc1e1e002c6c2d7b7c635699944a708d260d # v3
      continue-on-error: true
      with:
        image: ${{ inputs.docker-image }}
        image_sha: ${{ steps.docker_build.outputs.digest || steps.docker_retag.outputs.digest }}
        upwind_client_id: ${{ inputs.upwind-client-id }}
        upwind_client_secret: ${{ env.UPWIND_CLIENT_SECRET }}
        upwind_organization_id: ${{ inputs.upwind-organization-id }}

branding:
  icon: 'git-merge'
  color: 'blue'