action.yaml

---
name: container-build-and-release-action
description: Build container if underlying Dockerfile changed.
branding:
  icon: anchor
  color: blue
inputs:
  dockerfile-location:
    description: The path to the Dockerfile that should be built and released.
    required: true
  registry:
    description: The registry the image should be published to.
    required: true
  artifact-name:
    description: The artifact name of the generated and pushed image.
    required: true
  namespace:
    description: The namespace of the generated and published image.
    required: false
    default: ${{ github.repository }}
  username:
    description: The username to log into the container registry.
    required: false
    default: ${{ github.actor }}
  password:
    description: The password to log into the container registry.
    required: true
  min-versions-to-keep:
    description: Minimum amount of built images to keep in the registry. Delete the rest.
    required: false
    default: -1 # Do not delete any.
  create-attest:
    description: Define whether the attestation file should be created and pushed or not (ghcr.io does not support attestation files for private repositories).
    required: false
    default: true
  github-token:
    description: The GitHub token used to make authenticated API requests.
    default: ${{ github.token }}
    required: false
  force-build:
    description: If enabled, a new image is built regardless of whether the corresponding Dockerfile has changed.
    default: false
    required: false

runs:
  using: composite
  steps:
    - uses: actions/checkout@v4
      with:
        fetch-depth: 0 # We need the entire history to check if the Dockerfile has changed

    - name: Check if Dockerfile changed
      shell: bash
      run: |
        ${{ github.action_path }}/scripts/compute-file-change.sh ${{ github.event.before }} ${{ github.sha }} ${{ inputs.dockerfile-location }}

    - name: Force build of Dockerfile if force input is set
      shell: bash
      run: |
        ${{ github.action_path }}/scripts/force-build.sh ${{ inputs.force-build }}

    - name: Set environment variables
      if: fromJSON(env.DOCKERFILE_CHANGED)
      shell: bash
      run: |
        ${{ github.action_path }}/scripts/set-registry-variables.sh ${{ inputs.registry }} ${{ inputs.namespace }} ${{ inputs.artifact-name }}

    - name: Log in to the container registry
      if: fromJSON(env.DOCKERFILE_CHANGED)
      uses: docker/login-action@v3
      with:
        registry: ${{ inputs.registry }}
        username: ${{ inputs.username }}
        password: ${{ inputs.password }}

    - name: Extract metadata (tags, labels) for Docker
      if: fromJSON(env.DOCKERFILE_CHANGED)
      id: meta
      uses: docker/metadata-action@v5
      with:
        images: ${{ env.IMAGE_URL }}

    - name: Build and push Docker image
      if: fromJSON(env.DOCKERFILE_CHANGED)
      id: push
      uses: docker/build-push-action@v6
      with:
        context: .
        file: ${{ inputs.dockerfile-location }}
        push: true
        tags: |
          ${{ env.IMAGE_URL }}:latest
          ${{ env.IMAGE_URL }}:${{ github.sha }}
          ${{ steps.meta.outputs.tags }}
        labels: ${{ steps.meta.outputs.labels }}

    - name: Delete old container images
      if: fromJSON(env.DOCKERFILE_CHANGED)
      uses: actions/delete-package-versions@v5
      with:
        package-name: ${{ env.PACKAGE_NAME }}
        package-type: container
        min-versions-to-keep: ${{ inputs.min-versions-to-keep }}

    - name: Generate artifact attestation
      if: fromJSON(env.DOCKERFILE_CHANGED) && fromJSON(inputs.create-attest)
      uses: actions/attest-build-provenance@v2
      with:
        subject-name: ${{ env.IMAGE_URL }}
        subject-digest: ${{ steps.push.outputs.digest }}
        push-to-registry: true
        github-token: ${{ inputs.github-token }}