build.yaml

name: Build Docker
on:
  workflow_call:
    inputs:
      region:
        required: false
        type: string
        default: "us-east-1"
        description: "AWS region"
      tags:
        required: true
        type: string
        description: "Docker build tags"
      registry:
        required: true
        type: string
        description: "Registry image name"
      dockerfile_path:
        required: false
        type: string
        default: build/Dockerfile
        description: "Dockerfile relative path"
      docker_target:
        required: false
        type: string
        default: ""
        description: "Dockerfile target"
      runner:
        required: false
        type: string
        default: "non-prod"
        description: "Runner type"
      multiplatform:
        required: false
        type: boolean
        default: false
        description: "Multiplatform build"
    secrets:
      API_TOKEN_GITHUB:
        required: true
        description: "Github token hash"
      AWS_ACCESS_KEY_ID:
        required: true
        description: "AWS access key id"
      AWS_SECRET_ACCESS_KEY:
        required: true
        description: "AWS secret access key"
jobs:
  release:
    name: Build Docker
    if: ${{ ! inputs.multiplatform }}
    runs-on: ${{ inputs.runner }}
    steps:
      - name: Setup | Checkout
        uses: actions/checkout@v4
        with:
          submodules: true
          token: ${{ secrets.API_TOKEN_GITHUB }}

      - name: Docker | Build and Push
        uses: timescale/cloud-actions/build-push@main
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          region: ${{ inputs.region }}
          tags: |
            ${{ inputs.tags }}
          registry: ${{ inputs.registry }}
          target: ${{ inputs.docker_target }}
          file: ${{ inputs.dockerfile_path }}

  mp-build:
    name: Build multiplatform Image (${{ matrix.platform }})
    if: ${{ inputs.multiplatform }}
    runs-on: ["self-hosted", "${{ matrix.runs_on }}"]
    strategy:
      fail-fast: false
      matrix:
        platform: ["amd64", "arm64"]
        include:
          - platform: amd64
            runs_on: dev-us-east-1
          - platform: arm64
            runs_on: arm64
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          submodules: true
          token: ${{ secrets.API_TOKEN_GITHUB }}

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ inputs.registry }}
          tags: |
            type=raw,value=${{ inputs.tags }}

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ inputs.region }}

      - name: Login to Amazon ECR
        uses: aws-actions/amazon-ecr-login@v2

      - name: Build and push by digest
        id: build
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ${{ inputs.dockerfile_path }}
          platforms: linux/${{ matrix.platform }}
          target: ${{ inputs.docker_target }}
          labels: ${{ steps.meta.outputs.labels }}
          outputs: type=image,name=${{ inputs.registry }},push-by-digest=true,name-canonical=true,push=true
          build-args: |
            GOOS=linux
            GOARCH=${{ matrix.platform }}
            BPF_TARGET=${{ matrix.platform }}

      - name: Export digest
        run: |
          rm -rf /tmp/digests/*
          mkdir -p /tmp/digests
          digest="${{ steps.build.outputs.digest }}"
          export "IMAGE_DIGEST=${digest#sha256:}"
          echo "IMAGE_DIGEST=${IMAGE_DIGEST}" >> $GITHUB_ENV
          touch "/tmp/digests/${IMAGE_DIGEST}"

      - name: Upload digest
        uses: actions/upload-artifact@v4
        with:
          name: digests-${{ inputs.docker_target }}-${{ env.IMAGE_DIGEST }}
          path: /tmp/digests/*
          if-no-files-found: error
          retention-days: 1
  merge:
    runs-on: ${{ inputs.runner }}
    needs:
      - mp-build
    steps:
      - name: Cleanup digests path
        run: |
          mkdir -p /tmp/digests
          rm -rf /tmp/digests/*

      - name: Download digests
        uses: actions/download-artifact@v4
        with:
          path: /tmp/digests
          pattern: digests-${{ inputs.docker_target }}-*
          merge-multiple: true

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ inputs.registry }}
          tags: |
            type=raw,value=${{ inputs.tags }}

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ inputs.region }}

      - name: Login to Amazon ECR
        uses: aws-actions/amazon-ecr-login@v2

      - name: Create manifest list and push
        working-directory: /tmp/digests
        run: |
          docker buildx imagetools create --dry-run $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
            $(printf '${{ inputs.registry }}@sha256:%s ' *)
          docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
            $(printf '${{ inputs.registry }}@sha256:%s ' *)