build-ecr-image.yml

---

name: 'Build docker image for ECR'

on:
  workflow_call:
    inputs:
      ref:
        description: 'The branch/sha/tag to build from'
        type: string
        default: ''

      repository-name:
        description: 'The name of the ecr repository to push the docker image to'
        type: string
        required: true

      aws-region:
        description: 'The aws region where resources live'
        type: string
        default: us-east-1

      role-name:
        description: 'The name of the IAM role allowed to upload the ECR repository'
        type: string
        required: true

      skip-if-exists:
        description: 'If true, skips all build steps if the image already exists.  This is helpful for immutable ECR repositories'
        type: boolean
        default: false

      # begin docker/setup-buildx-action inputs
      buildx-version:
        description: 'Buildx version. (eg. v0.3.0)'
        required: false
        type: string
      driver:
        description: 'Sets the builder driver to be used'
        default: 'docker-container'
        required: false
        type: string
      driver-opts:
        description: 'List of additional driver-specific options. (eg. image=moby/buildkit:master)'
        required: false
        type: string
      buildkitd-flags:
        description: 'Flags for buildkitd daemon'
        default: '--allow-insecure-entitlement security.insecure --allow-insecure-entitlement network.host'
        required: false
        type: string
      install:
        description: 'Sets up docker build command as an alias to docker buildx build'
        default: 'false'
        required: false
        type: string
      use:
        description: 'Switch to this builder instance'
        default: 'true'
        required: false
        type: string
      endpoint:
        description: 'Optional address for docker socket or context from `docker context ls`'
        required: false
        type: string
      platforms:
        description: 'Fixed platforms for current node. If not empty, values take priority over the detected ones'
        required: false
        type: string
      config:
        description: 'BuildKit config file'
        required: false
        type: string
      config-inline:
        description: 'Inline BuildKit config'
        required: false
        type: string
      append:
        description: 'Append additional nodes to the builder'
        required: false
        type: string
      # end docker/setup-buildx-action inputs

      # begin docker/build-push-action inputs
      add-hosts:
        description: "List of a customs host-to-IP mapping (e.g., docker:10.180.0.1)"
        required: false
        type: string
      allow:
        description: "List of extra privileged entitlement (e.g., network.host,security.insecure)"
        required: false
        type: string
      attests:
        description: "List of attestation parameters (e.g., type=sbom,generator=image)"
        required: false
        type: string
      build-args:
        description: "List of build-time variables"
        required: false
        type: string
      build-contexts:
        description: "List of additional build contexts (e.g., name=path)"
        required: false
        type: string
      builder:
        description: "Builder instance"
        required: false
        type: string
      cache-from:
        description: "List of external cache sources for buildx (e.g., user/app:cache, type=local,src=path/to/dir)"
        required: false
        type: string
      cache-to:
        description: "List of cache export destinations for buildx (e.g., user/app:cache, type=local,dest=path/to/dir)"
        required: false
        type: string
      cgroup-parent:
        description: "Optional parent cgroup for the container used in the build"
        required: false
        type: string
      context:
        description: "Build's context is the set of files located in the specified PATH or URL"
        required: false
        type: string
        default: . # uses checkout ref
      file:
        description: "Path to the Dockerfile"
        required: false
        type: string
      labels:
        description: "List of metadata for an image"
        required: false
        type: string
      load:
        description: "Load is a shorthand for --output=type=docker"
        required: false
        default: 'false'
        type: string
      network:
        description: "Set the networking mode for the RUN instructions during build"
        required: false
        type: string
      no-cache:
        description: "Do not use cache when building the image"
        required: false
        default: 'false'
        type: string
      no-cache-filters:
        description: "Do not cache specified stages"
        required: false
        type: string
      outputs:
        description: "List of output destinations (format: type=local,dest=path)"
        required: false
        type: string
      # duplicate from buildx action
      # platforms:
      #   description: "List of target platforms for build"
      #   required: false
      provenance:
        description: "Generate provenance attestation for the build (shorthand for --attest=type=provenance)"
        required: false
        type: string
      pull:
        description: "Always attempt to pull all referenced images"
        required: false
        default: 'false'
        type: string
      push:
        description: "Push is a shorthand for --output=type=registry"
        required: false
        default: 'true' # BD default
        type: string
      sbom:
        description: "Generate SBOM attestation for the build (shorthand for --attest=type=sbom)"
        required: false
        type: string
      secret-files:
        description: "List of secret files to expose to the build (e.g., key=filename, MY_SECRET=./secret.txt)"
        required: false
        type: string
      shm-size:
        description: "Size of /dev/shm (e.g., 2g)"
        required: false
        type: string
      ssh:
        description: "List of SSH agent socket or keys to expose to the build"
        required: false
        type: string
      tags:
        description: "List of tags"
        required: false
        type: string
      target:
        description: "Sets the target stage to build"
        required: false
        type: string
      ulimit:
        description: "Ulimit options (e.g., nofile=1024:1024)"
        required: false
        type: string
      # end docker/build-push-action inputs

      # notify-slack
      notify-slack:
        description: 'Indicates if a slack notification should go out before and after the deploy'
        type: boolean
        default: false

      application:
        description: 'The name of the application; required if notify-slack is true'
        type: string
        required: false

      slack-template:
        description: 'The j2 template to pass to the notify-slack action'
        type: string
        required: false

    secrets:
      aws-account-id:
        description: 'The AWS account id that the ecr repository lives under'
        required: true

      ssh-private-key:
        description: 'If using private repositories for dependencies, the ssh key to add to the agent and pass along to the docker build'
        required: false

      secrets:
        description: "List of secrets to expose to the build (e.g., key=string, GIT_AUTH_TOKEN=mytoken)"
        required: false

      github-token:
        description: "GitHub Token used to authenticate against a repository for Git context"
        required: false

      slack-webhook-url:
        description: 'The webhook URL to send the slack notification to; requires notify-slack to be true'
        required: false

env:
  DOCKER_IMAGE: ${{ secrets.aws-account-id }}.dkr.ecr.${{ inputs.aws-region }}.amazonaws.com/${{ inputs.repository-name }}
  DEPLOY_IAM_ROLE: arn:aws:iam::${{ secrets.aws-account-id }}:role/${{ inputs.role-name }}

defaults:
  run:
    shell: bash

jobs:
  build-docker-image:
    name: 'Build docker image'
    runs-on: ubuntu-latest
    steps:
      - name: 'Checkout'
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.ref }}

      - name: 'Resolve sha from ref'
        id: sha
        run: |
          sha="$(git rev-parse HEAD)"
          echo "sha=$sha" >> $GITHUB_OUTPUT

      - name: 'Configure AWS credentials'
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: ${{ inputs.aws-region }}
          role-to-assume: ${{ env.DEPLOY_IAM_ROLE }}
          role-duration-seconds: 1200

      - name: 'Login to Amazon ECR'
        uses: aws-actions/amazon-ecr-login@v2

      - name: 'Check if the image already exists'
        id: already-exists
        run: |
          # Do not error out if it does not exist
          set +e

          answer=false
          aws ecr describe-images --output json --no-cli-pager \
            --repository-name=${{ inputs.repository-name }} \
            --image-ids=imageTag=${{ steps.sha.outputs.sha }}
          if [ "$?" -eq 0 ]; then
            answer=true
          fi
          echo "answer=$answer" >> "$GITHUB_OUTPUT"

      - name: 'Notify slack of build started'
        if: (inputs.skip-if-exists == false || steps.already-exists.outputs.answer == 'false') && inputs.notify-slack == true
        uses: shopsmart/github-actions/actions/notify-slack@v4
        with:
          application: ${{ inputs.application }}
          status: started
          type: build
          template: ${{ inputs.slack-template }}
          version: ${{ inputs.ref || steps.sha.outputs.sha }}
          slack-webhook-url: ${{ secrets.slack-webhook-url }}

      - name: 'Is github release?'
        id: is-gh-release
        if: inputs.skip-if-exists == false || steps.already-exists.outputs.answer == 'false'
        uses: shopsmart/github-actions/actions/is-gh-release@v4
        with:
          ref: ${{ inputs.ref }}

      - name: 'If release, add additional tag'
        id: additional-tag
        if: inputs.skip-if-exists == false || steps.already-exists.outputs.answer == 'false'
        run: |
          additional_tag=''
          if [[ "${{ steps.is-gh-release.outputs.is-release }}" == 'true' ]]; then
            additional_tag="${{ env.DOCKER_IMAGE }}:${{ inputs.ref }}"
          fi
          echo "tag=$additional_tag" >> $GITHUB_OUTPUT

      - name: 'If ssh private key provided, pass the default ssh agent'
        id: ssh
        if: inputs.skip-if-exists == false || steps.already-exists.outputs.answer == 'false'
        run: |
          ssh=''
          if [ -n "${{ secrets.ssh-private-key }}" ]; then
            ssh=default
          fi
          echo "ssh=$ssh" >> $GITHUB_OUTPUT

      # for private dependencies
      - name: 'Install SSH Key'
        if: (inputs.skip-if-exists == false || steps.already-exists.outputs.answer == 'false') && steps.ssh.outputs.ssh != ''
        uses: webfactory/ssh-agent@v0.9.0
        with:
          ssh-private-key: ${{ secrets.ssh-private-key }}

      - name: 'Setup docker buildx'
        if: inputs.skip-if-exists == false || steps.already-exists.outputs.answer == 'false'
        uses: docker/setup-buildx-action@v3
        with:
          version: ${{ inputs.buildx-version }}
          driver: ${{ inputs.driver }}
          driver-opts: ${{ inputs.driver-opts }}
          buildkitd-flags: ${{ inputs.buildkitd-flags }}
          install: ${{ inputs.install }}
          use: ${{ inputs.use }}
          endpoint: ${{ inputs.endpoint }}
          platforms: ${{ inputs.platforms }}
          config: ${{ inputs.config }}
          config-inline: ${{ inputs.config-inline }}
          append: ${{ inputs.append }}

      - name: 'Build docker image'
        if: inputs.skip-if-exists == false || steps.already-exists.outputs.answer == 'false'
        uses: docker/build-push-action@v6
        with:
          add-hosts: ${{ inputs.add-hosts }}
          allow: ${{ inputs.allow }}
          attests: ${{ inputs.attests }}
          build-args: ${{ inputs.build-args }}
          build-contexts: ${{ inputs.build-contexts }}
          builder: ${{ inputs.builder }}
          cache-from: ${{ inputs.cache-from }}
          cache-to: ${{ inputs.cache-to }}
          cgroup-parent: ${{ inputs.cgroup-parent }}
          context: ${{ inputs.context }}
          file: ${{ inputs.file }}
          labels: |
            github.sha=${{ steps.sha.outputs.sha }}
            github.ref=${{ inputs.ref }}
            ${{ inputs.labels }}
          load: ${{ inputs.load }}
          network: ${{ inputs.network }}
          no-cache: ${{ inputs.no-cache }}
          no-cache-filters: ${{ inputs.no-cache-filters }}
          outputs: ${{ inputs.outputs }}
          platforms: ${{ inputs.platforms }}
          provenance: ${{ inputs.provenance }}
          pull: ${{ inputs.pull }}
          push: ${{ inputs.push }}
          sbom: ${{ inputs.sbom }}
          secrets: |
            GIT_AUTH_TOKEN=${{ secrets.github-token || github.token }}
            ${{ secrets.secrets }}
          secret-files: ${{ inputs.secret-files }}
          shm-size: ${{ inputs.shm-size }}
          ssh: |
            ${{ steps.ssh.outputs.ssh }}
            ${{ inputs.ssh }}
          tags: |
            ${{ env.DOCKER_IMAGE }}:${{ steps.sha.outputs.sha }}
            ${{ steps.additional-tag.outputs.tag }}
            ${{ inputs.tags }}
          target: ${{ inputs.target }}
          ulimit: ${{ inputs.ulimit }}
          github-token: ${{ secrets.github-token || github.token }}

      - name: 'Pull and package docker image'
        if: (inputs.skip-if-exists == false || steps.already-exists.outputs.answer == 'false') && steps.is-gh-release.outputs.is-release == 'true'
        env:
          NAME: ${{ inputs.repository-name }}
          IMAGE: ${{ env.DOCKER_IMAGE }}:${{ steps.sha.outputs.sha }}
          TAG: ${{ inputs.ref }}
        run: |
          set -eo pipefail
          echo "[INFO ] Exporting $IMAGE and zipping to docker-image-$NAME-$TAG.tgz" >&2
          docker pull "$IMAGE"
          docker save "$IMAGE" | gzip > "docker-image-$NAME-$TAG.tgz"

      - name: 'Upload docker image'
        if: (inputs.skip-if-exists == false || steps.already-exists.outputs.answer == 'false') && steps.is-gh-release.outputs.is-release == 'true'
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ inputs.ref }}
          files: docker-image-*.tgz
          token: ${{ secrets.github-token || github.token }}

      - name: 'Notify slack of build status'
        if: always() && (inputs.skip-if-exists == false || steps.already-exists.outputs.answer == 'false') && inputs.notify-slack == true
        uses: shopsmart/github-actions/actions/notify-slack@v4
        with:
          application: ${{ inputs.application }}
          status: ${{ job.status }}
          type: build
          template: ${{ inputs.slack-template }}
          version: ${{ inputs.ref || steps.sha.outputs.sha }}
          slack-webhook-url: ${{ secrets.slack-webhook-url }}