reusable.yml

on:
  workflow_call:
    inputs:
      image:
        required: true
        type: string
      tag:
        required: true
        type: number
      arg:
        required: false
        type: string
        default: ${{ inputs.tag }}
      multiplatform:
        required: false
        type: boolean
        default: false
      sign:
        required: false
        type: boolean
        default: false
env:
  # Use ghcr.io for GitHub Container Registry if empty
  REGISTRY: ghcr.io

jobs:
  build:
    name: Add temporary packages for testing
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      # This is used to complete the identity challenge with sigstore/fulcio.
      # It isn't possible to use `${{ inputs.sign && write || none }}` here.
      id-token: write
    steps:
      - uses: actions/checkout@v4
      # Install the cosign tool
      # https://github.com/sigstore/cosign-installer
      - name: Install cosign
        if: ${{ inputs.sign }}
        uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da #v3.7.0
        with:
          cosign-release: 'v2.4.1'
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      # Extract metadata (tags, labels) for Docker,
      # set environments required for signing.
      # Automatically sanitize tags (lowercasing,
      # replace spaces with '_', etc.)
      # https://github.com/docker/metadata-action
      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@369eb591f429131d6889c46b94e711f089e6ca96 # v5.6.1
        with:
          images: ${{ env.REGISTRY }}/${{ github.repository_owner }}/${{ inputs.image }}
          tags: type=raw,value=${{ inputs.tag }}
      - name: Build and push
        uses: docker/build-push-action@v5
        id: build-and-push
        with:
          file: ./CICD/Dockerfile_temp
          tags: ${{ steps.meta.outputs.tags }}
          build-args: I=${{ inputs.arg }}
          push: true
          platforms: ${{ inputs.multiplatform && 'linux/amd64,linux/arm64' || 'linux/amd64' }}
          # Disable automatic manifest list by disabling attestation facts generation
          provenance: ${{ !inputs.sign }}
          sbom:       ${{ !inputs.sign }}
      # Sign the resulting Docker image digest
      # https://github.com/sigstore/cosign
      - name: Sign the published Docker image
        if: ${{ inputs.sign }}
        env:
          TAGS: ${{ steps.meta.outputs.tags }}
          DIGEST: ${{ steps.build-and-push.outputs.digest }}
        # This step uses the identity token to provision an ephemeral certificate
        # against the sigstore community Fulcio instance.
        run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}