---
name: Build and Push Docker Image
on:
workflow_call:
inputs:
npm_version:
description: "The npm package version to publish, without the prefix `v` (e.g., 1.2.3)"
required: true
type: string
release_channel:
description: "The release channel. Normally we only use latest and prerelease"
required: true
type: string
secrets:
DOCKERHUB_USERNAME:
required: true
DOCKERHUB_PASSWORD:
required: true
jobs:
build-push:
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- name: Check out code
uses: actions/checkout@v6
with:
persist-credentials: false
- name: Generate Docker tags
id: docker-tags
env:
NPM_VERSION_INPUT: "${{ inputs.npm_version }}"
RELEASE_CHANNEL_INPUT: "${{ inputs.release_channel }}"
DOCKERHUB_REPOSITORY: "${{ vars.DOCKERHUB_IMAGE_REPOSITORY }}"
run: |
set -e
NPM_VERSION="$NPM_VERSION_INPUT"
# Strip 'v' prefix if present
NPM_VERSION="${NPM_VERSION#v}"
RELEASE_CHANNEL="$RELEASE_CHANNEL_INPUT"
REPO="$DOCKERHUB_REPOSITORY"
DATE=$(date +'%Y-%m-%d')
CHANNEL_TAG="$RELEASE_CHANNEL"
VERSION_TAG="$NPM_VERSION"
VERSION_DATE_TAG="${NPM_VERSION}-${DATE}"
# We always include the floating tags
DOCKER_TAGS="${REPO}:${CHANNEL_TAG},${REPO}:${VERSION_TAG}"
# VERSION_DATE_TAG is included only if it does not exist already
HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
"https://hub.docker.com/v2/repositories/${REPO}/tags/${VERSION_DATE_TAG}")
if [[ "$HTTP_STATUS" == "200" ]]; then
echo "::notice::Tag ${VERSION_DATE_TAG} already exists, skipping immutable tag"
else
echo "::notice::Tag ${VERSION_DATE_TAG} does not exist, will be created"
DOCKER_TAGS="${DOCKER_TAGS},${REPO}:${VERSION_DATE_TAG}"
fi
echo "DOCKER_TAGS=${DOCKER_TAGS}" >> "$GITHUB_OUTPUT"
echo "VERSION=${NPM_VERSION}" >> "$GITHUB_OUTPUT"
echo "::notice::Docker tags to publish: ${DOCKER_TAGS}"
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
- name: Login to Docker Hub
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef
with:
username: "${{ secrets.DOCKERHUB_USERNAME }}"
password: "${{ secrets.DOCKERHUB_PASSWORD }}"
- name: Build and push image to dockerhub registry
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83
with:
context: .
platforms: linux/amd64,linux/arm64
tags: ${{ steps.docker-tags.outputs.DOCKER_TAGS }}
file: Dockerfile
push: true
provenance: mode=max
sbom: true
build-args: |
VERSION=${{ steps.docker-tags.outputs.VERSION }}
