reusable-docker-build.yml

name: Docker Build (Cached)

on:
  workflow_call:
    secrets:
      SENTRY_AUTH_TOKEN:
        required: false
      SENTRY_ORG:
        required: false
      SENTRY_PROJECT:
        required: false
    inputs:
      image-name:
        type: string
        required: true
        description: "Full image name (e.g., hephaestus-build/webapp)"
      docker-file:
        type: string
        required: false
        default: ""
        description: "Path to Dockerfile (required unless use-buildpacks=true)"
      docker-context:
        type: string
        default: "."
        description: "Docker build context"
      use-buildpacks:
        type: boolean
        required: false
        default: false
        description: |
          If true, build via Paketo Cloud Native Buildpacks using
          spring-boot:build-image instead of a Dockerfile. Used for the application
          server to enable Application CDS — see docs/admin/buildpacks-cds-decision.md.
      maven-module:
        type: string
        required: false
        default: ""
        description: "Directory containing the Spring Boot module when use-buildpacks=true (e.g. server/application)"
      registry:
        type: string
        default: "ghcr.io"
        description: "Container registry"
      labels:
        type: string
        required: false
        description: "OCI labels"
      build-args:
        type: string
        required: false
        description: "Build arguments"
      single-arch:
        type: boolean
        required: false
        default: false
        description: "Build only linux/amd64 instead of the supported multi-architecture set."
    outputs:
      manifest-digest:
        description: "Published image digest; an index digest for multi-architecture builds."
        value: ${{ inputs.single-arch && jobs.build.outputs.manifest-digest || jobs.merge.outputs.manifest-digest }}

env:
  STANDARD_IMAGE_TAGS: |
    ${{ github.event_name == 'push' && github.ref_name || '' }}
    ${{ github.event_name == 'push' && github.sha || '' }}
    ${{ github.event_name == 'push' && format('ci-{0}', github.run_number) || '' }}
    ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || '' }}
    ${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.number) || '' }}
    run-${{ github.run_id }}-${{ github.run_attempt }}

jobs:
  build:
    name: Build ${{ matrix.platform }} Docker Image
    outputs:
      manifest-digest: ${{ steps.single-digest.outputs.manifest-digest }}
    strategy:
      fail-fast: true
      matrix: ${{ fromJSON(inputs.single-arch && '{"include":[{"platform":"linux/amd64","runner":"ubuntu-24.04"}]}' || '{"include":[{"platform":"linux/amd64","runner":"ubuntu-24.04"},{"platform":"linux/arm64","runner":"ubuntu-24.04-arm"}]}') }}
    timeout-minutes: 45
    runs-on: ${{ matrix.runner }}
    permissions:
      contents: read
      packages: write
      id-token: write
      attestations: write
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 1
          persist-credentials: false

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
        with:
          # Avoid anonymous Docker Hub pull limits.
          buildkitd-config-inline: |
            [registry."docker.io"]
              mirrors = ["https://docker-mirror.ase.in.tum.de:8765"]

      - name: Log in to Container Registry
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ${{ inputs.registry }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Prepare tag configuration
        id: tags
        if: inputs.single-arch
        run: |
          {
            echo "tags<<EOF"
            while IFS= read -r line || [[ -n "$line" ]]; do
              line=$(echo "$line" | xargs)
              [ -z "$line" ] && continue
              if [[ "$line" == *"type="* ]]; then
                echo "$line"
              else
                IFS=',' read -ra values <<< "$line"
                for value in "${values[@]}"; do
                  value=$(echo "$value" | xargs)
                  [ -n "$value" ] && echo "type=raw,value=$value"
                done
              fi
            done <<< "$STANDARD_IMAGE_TAGS"
            echo "EOF"
          } >> "$GITHUB_OUTPUT"

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        with:
          images: ${{ inputs.registry }}/${{ inputs.image-name }}
          tags: ${{ inputs.single-arch && steps.tags.outputs.tags || '' }}
          labels: ${{ inputs.labels }}

      - name: Prepare platform pair
        id: prep
        run: |
          platform=$MATRIX_PLATFORM
          echo "platform_pair=${platform//\//-}" >> $GITHUB_OUTPUT
          image="$INPUT_IMAGE_NAME"
          echo "image_name=${image//\//-}" >> $GITHUB_OUTPUT
        env:
          INPUT_IMAGE_NAME: ${{ inputs.image-name }}
          MATRIX_PLATFORM: ${{ matrix.platform }}

      - name: Build and push (Dockerfile)
        id: build
        if: ${{ !inputs.use-buildpacks }}
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        env:
          DOCKER_BUILD_RECORD_UPLOAD: false
        with:
          context: ${{ inputs.docker-context }}
          file: ${{ inputs.docker-file }}
          platforms: ${{ matrix.platform }}
          build-args: ${{ inputs.build-args }}
          secrets: |
            sentry_auth_token=${{ github.event_name == 'push' && matrix.platform == 'linux/amd64' && secrets.SENTRY_AUTH_TOKEN || '' }}
            sentry_org=${{ github.event_name == 'push' && matrix.platform == 'linux/amd64' && secrets.SENTRY_ORG || '' }}
            sentry_project=${{ github.event_name == 'push' && matrix.platform == 'linux/amd64' && secrets.SENTRY_PROJECT || '' }}
          labels: ${{ steps.meta.outputs.labels }}
          tags: ${{ inputs.single-arch && steps.meta.outputs.tags || '' }}
          push: ${{ inputs.single-arch }}
          outputs: ${{ !inputs.single-arch && format('type=image,"name={0}/{1}",push-by-digest=true,name-canonical=true,push=true', inputs.registry, inputs.image-name) || '' }}
          cache-from: |
            type=registry,ref=${{ inputs.registry }}/${{ inputs.image-name }}:cache-main-${{ steps.prep.outputs.platform_pair }}
          cache-to: ${{ github.ref == 'refs/heads/main' && format('type=registry,ref={0}/{1}:cache-main-{2},mode=max', inputs.registry, inputs.image-name, steps.prep.outputs.platform_pair) || '' }}

      - name: Set up JDK 21
        if: inputs.use-buildpacks
        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
        with:
          distribution: temurin
          java-version: 21

      - name: Cache Maven dependencies
        if: inputs.use-buildpacks
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ~/.m2/repository
          key: m2-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('**/pom.xml') }}
          restore-keys: |
            m2-${{ runner.os }}-${{ runner.arch }}-

      - name: Validate buildpacks inputs
        if: inputs.use-buildpacks
        run: |
          if [ -z "$INPUT_MAVEN_MODULE" ]; then
            echo "::error::use-buildpacks=true requires maven-module (e.g. server/application)"
            exit 1
          fi
        env:
          INPUT_MAVEN_MODULE: ${{ inputs.maven-module }}

      - name: Build and push (Paketo Buildpacks + CDS)
        id: build-buildpacks
        if: inputs.use-buildpacks
        working-directory: ${{ inputs.maven-module }}
        env:
          DOCKER_PUBLISH_REGISTRY_URL: https://${{ inputs.registry }}
          DOCKER_PUBLISH_REGISTRY_USERNAME: ${{ github.actor }}
          DOCKER_PUBLISH_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
          INPUT_IMAGE_NAME: ${{ inputs.image-name }}
          INPUT_REGISTRY: ${{ inputs.registry }}
          MATRIX_PLATFORM: ${{ matrix.platform }}
          PLATFORM_PAIR: ${{ steps.prep.outputs.platform_pair }}
        run: |
          set -euo pipefail
          PER_ARCH_TAG="$INPUT_REGISTRY/$INPUT_IMAGE_NAME:ci-$GITHUB_RUN_ID-$PLATFORM_PAIR"
          ../mvnw -B -ntp -f ../pom.xml -pl generated-clients -am install -DskipTests=true
          ../mvnw -B -ntp spring-boot:build-image -DskipTests=true \
            -Dspring-boot.build-image.imageName="$PER_ARCH_TAG" \
            -Dspring-boot.build-image.imagePlatform="$MATRIX_PLATFORM" \
            -Dspring-boot.build-image.publish=true \
            -Ddocker.publishRegistry.url="$DOCKER_PUBLISH_REGISTRY_URL" \
            -Ddocker.publishRegistry.username="$DOCKER_PUBLISH_REGISTRY_USERNAME" \
            -Ddocker.publishRegistry.password="$DOCKER_PUBLISH_REGISTRY_PASSWORD"
          # Buildpacks may wrap one platform in an index; capture its manifest, not the wrapper.
          RAW=$(docker buildx imagetools inspect "$PER_ARCH_TAG" --format '{{json .Manifest}}')
          if echo "$RAW" | jq -e '.manifests' >/dev/null 2>&1; then
            ARCH=$(echo "$MATRIX_PLATFORM" | awk -F/ '{print $2}')
            DIGEST=$(echo "$RAW" | jq -r --arg arch "$ARCH" \
              '.manifests[] | select(.platform.architecture == $arch and .platform.os == "linux") | .digest')
          else
            DIGEST=$(echo "$RAW" | jq -r '.digest')
          fi
          if [[ ! "$DIGEST" =~ ^sha256:[a-f0-9]{64}$ ]]; then
            echo "::error::Refusing to publish: per-arch digest is not a sha256:<64 hex> (got: ${DIGEST:-<empty>})"
            exit 1
          fi
          echo "digest=$DIGEST" >> "$GITHUB_OUTPUT"
          echo "Per-arch digest: $DIGEST"

      - name: Export digest
        env:
          DOCKERFILE_DIGEST: ${{ steps.build.outputs.digest }}
          BUILDPACKS_DIGEST: ${{ steps.build-buildpacks.outputs.digest }}
        run: |
          mkdir -p ${{ runner.temp }}/digests
          digest="${BUILDPACKS_DIGEST:-$DOCKERFILE_DIGEST}"
          if [ -z "$digest" ]; then
            echo "::error::No digest produced by either build path"
            exit 1
          fi
          if [ "${{ inputs.single-arch }}" = "true" ]; then
            echo "manifest-digest=$digest" >> "$GITHUB_OUTPUT"
          else
            touch "${{ runner.temp }}/digests/${digest#sha256:}"
          fi

      - name: Apply tags to buildpack image
        if: inputs.single-arch && inputs.use-buildpacks
        env:
          SOURCE_IMAGE: ${{ inputs.registry }}/${{ inputs.image-name }}@${{ steps.build-buildpacks.outputs.digest }}
        run: |
          mapfile -t tags < <(jq -r '.tags[]' <<< "$DOCKER_METADATA_OUTPUT_JSON")
          args=()
          for tag in "${tags[@]}"; do
            args+=(--tag "$tag")
          done
          docker buildx imagetools create "${args[@]}" "$SOURCE_IMAGE"

      - name: Capture single-architecture digest
        id: single-digest
        if: inputs.single-arch
        env:
          IMAGE_TAG_REF: ${{ fromJSON(steps.meta.outputs.json).tags[0] }}
        run: |
          set -euo pipefail
          DIGEST=$(docker buildx imagetools inspect --format '{{.Manifest.Digest}}' "$IMAGE_TAG_REF")
          if [[ ! "$DIGEST" =~ ^sha256:[a-f0-9]{64}$ ]]; then
            echo "::error::Refusing to publish: image digest is invalid (got: ${DIGEST:-<empty>})"
            exit 1
          fi
          echo "manifest-digest=$DIGEST" >> "$GITHUB_OUTPUT"

      - name: Generate build provenance attestation
        if: inputs.single-arch
        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
        with:
          subject-name: ${{ inputs.registry }}/${{ inputs.image-name }}
          subject-digest: ${{ steps.single-digest.outputs.manifest-digest }}
          push-to-registry: true

      - name: Install Cosign
        if: inputs.single-arch
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2

      - name: Sign and verify image
        if: inputs.single-arch
        env:
          IMAGE_REF: ${{ inputs.registry }}/${{ inputs.image-name }}@${{ steps.single-digest.outputs.manifest-digest }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          cosign sign --yes "$IMAGE_REF"
          cosign verify "$IMAGE_REF" \
            --certificate-identity-regexp '^https://github\.com/${{ github.repository }}/\.github/workflows/reusable-docker-build\.yml@' \
            --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
            --certificate-github-workflow-repository "${{ github.repository }}" \
            > /dev/null
          gh attestation verify "oci://$IMAGE_REF" --owner "${{ github.repository_owner }}"

      - name: Upload digest
        if: ${{ !inputs.single-arch }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: digests-${{ steps.prep.outputs.image_name }}-${{ steps.prep.outputs.platform_pair }}
          path: ${{ runner.temp }}/digests/*
          if-no-files-found: error
          retention-days: 1

  merge:
    name: Create manifest
    timeout-minutes: 30
    runs-on: ubuntu-latest
    needs: build
    if: ${{ !inputs.single-arch }}
    permissions:
      packages: write
      id-token: write
      attestations: write
    outputs:
      manifest-digest: ${{ steps.digest.outputs.manifest-digest }}
    steps:
      - name: Prepare
        id: prep
        run: |
          image="${INPUTS_IMAGE_NAME}"
          echo "image_name=${image//\//-}" >> $GITHUB_OUTPUT
        env:
          INPUTS_IMAGE_NAME: ${{ inputs.image-name }}

      - name: Download digests
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          path: ${{ runner.temp }}/digests
          pattern: digests-${{ steps.prep.outputs.image_name }}-*
          merge-multiple: true

      - name: Log in to Container Registry
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ${{ inputs.registry }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0

      - name: Prepare tag configuration
        id: tags
        run: |
          {
            echo "tags<<EOF"
            if [ -n "${STANDARD_IMAGE_TAGS}" ]; then
              echo "${STANDARD_IMAGE_TAGS}" | while IFS= read -r line || [[ -n "$line" ]]; do
                line=$(echo "$line" | xargs)
                if [ -n "$line" ]; then
                  if [[ "$line" == *"type="* ]]; then
                    echo "$line"
                  else
                    IFS=',' read -ra TAG_ARRAY <<< "$line"
                    for tag in "${TAG_ARRAY[@]}"; do
                      tag=$(echo "$tag" | xargs)
                      if [ -n "$tag" ]; then
                        echo "type=raw,value=${tag}"
                      fi
                    done
                  fi
                fi
              done
            fi
            echo "EOF"
          } >> $GITHUB_OUTPUT

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        with:
          images: ${{ inputs.registry }}/${{ inputs.image-name }}
          tags: ${{ steps.tags.outputs.tags }}
          labels: ${{ inputs.labels }}

      - name: Create manifest and push
        working-directory: ${{ runner.temp }}/digests
        run: |
          mapfile -t tags < <(jq -er '.tags[]' <<< "$DOCKER_METADATA_OUTPUT_JSON")
          args=()
          for tag in "${tags[@]}"; do args+=(-t "$tag"); done
          for digest in *; do args+=("$INPUTS_REGISTRY/$INPUTS_IMAGE_NAME@sha256:$digest"); done
          docker buildx imagetools create "${args[@]}"
        env:
          INPUTS_REGISTRY: ${{ inputs.registry }}
          INPUTS_IMAGE_NAME: ${{ inputs.image-name }}

      - name: Inspect image
        run: docker buildx imagetools inspect "$IMAGE_REF"
        env:
          IMAGE_REF: ${{ inputs.registry }}/${{ inputs.image-name }}:${{ steps.meta.outputs.version }}

      - name: Capture manifest digest
        id: digest
        env:
          IMAGE_TAG_REF: ${{ inputs.registry }}/${{ inputs.image-name }}:${{ steps.meta.outputs.version }}
        run: |
          set -euo pipefail
          DIGEST=$(docker buildx imagetools inspect --format '{{.Manifest.Digest}}' "$IMAGE_TAG_REF")
          if [[ ! "$DIGEST" =~ ^sha256:[a-f0-9]{64}$ ]]; then
            echo "::error::Refusing to publish: manifest digest is not a sha256:<64 lowercase hex> value (got: ${DIGEST:-<empty>})"
            exit 1
          fi
          echo "manifest-digest=$DIGEST" >> "$GITHUB_OUTPUT"
          echo "Multi-arch manifest digest: $DIGEST"

      - name: Generate build provenance attestation
        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
        with:
          subject-name: ${{ inputs.registry }}/${{ inputs.image-name }}
          subject-digest: ${{ steps.digest.outputs.manifest-digest }}
          push-to-registry: true

      - name: Install Cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2

      # --recursive: sign each child manifest so per-platform verify works.
      - name: Sign image with cosign
        env:
          IMAGE_REF: ${{ inputs.registry }}/${{ inputs.image-name }}@${{ steps.digest.outputs.manifest-digest }}
        run: |
          cosign sign --yes --recursive "$IMAGE_REF"

      - name: Verify signature + attestation
        env:
          IMAGE_REF: ${{ inputs.registry }}/${{ inputs.image-name }}@${{ steps.digest.outputs.manifest-digest }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          cosign verify "$IMAGE_REF" \
            --certificate-identity-regexp '^https://github\.com/${{ github.repository }}/\.github/workflows/reusable-docker-build\.yml@' \
            --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
            --certificate-github-workflow-repository "${{ github.repository }}" \
            > /dev/null
          gh attestation verify "oci://$IMAGE_REF" --owner "${{ github.repository_owner }}"