docker_dockerhub_release_callable.yml

---
name: Build & Push Docker Image

# Only builds the image if a release was created.
# This guarantees the commit is tagged and on main branch.
# (see https://docs.github.com/en/repositories/releasing-projects-on-github/about-releases)

# yamllint disable-line rule:truthy
on:
  # USE_WORKFLOW
  workflow_call:
    inputs:
      image-name:
        type: string
        required: true
        description: "Name of the image. Usually it is sensible to set this to the repository name"
      push:
        type: boolean
        required: false
        description: "Flag to enable the workflow to actually push the built image to the registry"
        default: false
      upload-security-scan-results:
        type: boolean
        required: false
        description: "Upload results of trivy scan of docker image to Github Security page"
        default: false
# /USE_WORKFLOW
# USE_REPOSITORY
#  release:
# /USE_REPOSITORY

jobs:
  docker-build-push:
    runs-on: ubuntu-latest
    env:
      # hard-coded organization prefix here in order to push images
      IMAGE_NAME: hlag/${{ inputs.image-name }}
    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Configure Tags
        uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # v5.5.1
        id: meta
        with:
          images: ${{ env.IMAGE_NAME }}
          tags: |
            type=ref,event=pr
            type=edge,enable={{is_default_branch}}
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
            type=sha
      - name: Set up QEMU
        uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3.2.0
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3.7.1
      - name: Login to DockerHub Container Registry
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Build Image
        uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75 # v6.9.0
        with:
          context: .
          load: true
          tags: ${{ env.IMAGE_NAME }}:trivy-scan
          cache-from: type=gha
          cache-to: type=gha,mode=max
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@915b19bbe73b92a6cf82a1bc12b087c9a19a5fe2 # 0.28.0
        with:
          image-ref: ${{ env.IMAGE_NAME }}:trivy-scan
          format: "sarif"
          output: "trivy-results.sarif"
      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@ea9e4e37992a54ee68a9622e985e60c8e8f12d9f # v3.27.4
        if: ${{ inputs.upload-security-scan-results }}
        with:
          sarif_file: "trivy-results.sarif"
      - name: Build and push image
        uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75 # v6.9.0
        with:
          context: .
          push: ${{ inputs.push }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max