docker-buildx.yml

on:
  workflow_call:
    secrets:
      docker_hub_username:
        description: "Docker Hub username"
        required: false
      docker_hub_password:
        description: "Docker Hub password or token"
        required: false
      aws_assume_role:
        description: "AWS role to assume"
        required: false
    inputs:
      images:
        description: "Comma delimited list of images"
        required: true
        type: string
      copy_to_ecr_prefix:
        description: "ECR prefix to copy to"
        required: false
        type: string
      dockerfile:
        description: "Dockerfile to build"
        required: false
        type: string
        default: "Dockerfile"
      target:
        description: "Target to build"
        required: false
        type: string
      platform:
        description: "Platform to build"
        required: false
        type: string
        default: "linux/arm64,linux/amd64"
      # docker_build_args example - ["ARG1=value1","ARG2=value2"]
      docker_build_args:
        description: "Docker build args"
        required: false
        type: string
      use_remote:
        description: "Use remote buildx"
        required: false
        type: boolean
        default: false
      security_group_id:
        description: "Security Group ID"
        required: true
        type: string
      subnet_id:
        description: "Subnet ID"
        required: true
        type: string
      instance_profile:
        description: "Instance Profile"
        required: true
        type: string
      region:
        description: "Region"
        required: true
        type: string
      arm64-instance-type:
        description: "ARM64 Instance Type"
        required: false
        type: string
        default: "c7g.xlarge"
      amd64-instance-type:
        description: "AMD64 Instance Type"
        required: false
        type: string
        default: "c7i.xlarge"
jobs:
  prepare:
    runs-on: ubuntu-latest
    outputs:
        MATRIX: ${{ steps.set-matrix.outputs.MATRIX }}
    steps:
      - id: set-matrix
        run: |
          MATRIX="{\"images\": [$(echo \"${{ inputs.images }}\" | sed 's/,/\",\"/g')]}"
          echo "MATRIX=$MATRIX"
          echo "MATRIX=$MATRIX" >> $GITHUB_OUTPUT
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.docker_hub_username }}
          password: ${{ secrets.docker_hub_password }}
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3
        if: inputs.use_remote == false
      - name: Setup local buildx
        uses: docker/setup-buildx-action@v3
        if: inputs.use_remote == false
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v2
        if: inputs.use_remote == true
        with:
          role-to-assume: ${{ secrets.aws_assume_role }}
          aws-region: "us-east-1"
          role-duration-seconds: 22200 # 6 hours
      - name: Setup remote buildx
        id: buildx
        uses: truemark/aws-buildx-remote-docker-instance-action@v5
        if: inputs.use_remote == true
        with:
          security-group-id: "${{ inputs.security_group_id }}"
          subnet-id: "${{ inputs.subnet_id }}"
          instance-profile: "${{ inputs.instance_profile }}"
          region: "${{ inputs.region }}"
          arm64-instance-type: "${{ inputs.arm64-instance-type }}"
          amd64-instance-type: "${{ inputs.amd64-instance-type }}"
      - name: List builder instances
        run: docker buildx ls
      - name: Build Docker
        run: |
          ARGS=$(echo '${{ inputs.docker_build_args }}' | jq -r '.[]' | awk '{print "--build-arg " $0}')
          TARGET=""
          if [ -n "${{ inputs.target }}" ]; then
            TARGET="--target ${{ inputs.target }}"
          fi
          docker buildx build \
            --push \
            --platform ${{ inputs.platform }} \
            -f ${{ inputs.dockerfile }} \
            -t $(echo ${{ inputs.images }} | sed -e "s/,/ -t /g") \
            $TARGET $ARGS .
  copy-images:
    if: inputs.copy_to_ecr_prefix != null
    needs: [prepare, build]
    runs-on: ubuntu-latest
    strategy:
      matrix: "${{fromJson(needs.prepare.outputs.MATRIX)}}"
    steps:
      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.docker_hub_username }}
          password: ${{ secrets.docker_hub_password }}
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: "${{ secrets.aws_assume_role }}"
          aws-region: "us-east-1"
      - name: Login to ECR
        id: ecr-login
        uses: aws-actions/amazon-ecr-login@v2
        with:
          registry-type: public
      - name: Copy image to ECR
        run: |
          echo "Copying ${{ matrix.images }} to ECR"
          ECR_PREFIX=$(echo "${{ inputs.copy_to_ecr_prefix }}" | sed 's/\//\\\//g')
          ECR_IMAGE=$(echo "${{ matrix.images }}" | sed "s/.*\//${ECR_PREFIX}\//g")
          echo "ECR_IMAGE=$ECR_IMAGE" >> $GITHUB_ENV
      - name: Copy images to ECR
        uses: truemark/skopeo-copy-action@v1
        with:
          src-image: "docker://${{ matrix.images }}"
          dest-image: "docker://${{ env.ECR_IMAGE }}"
          src-username: ${{ secrets.docker_hub_username }}
          src-password: ${{ secrets.docker_hub_password }}
          dest-username: "${{ steps.ecr-login.outputs.docker_username_public_ecr_aws }}"
          dest-password: "${{ steps.ecr-login.outputs.docker_password_public_ecr_aws }}"