action.yml

name: 'Docker Build and Push'
description: 'Build and optionally push a docker image to ACR'
inputs:
  images:
    description: 'Name of images to build'
    required: true
  acr-username:
    description: 'Username to use when logging into ACR'
    required: true
  acr-password:
    description: 'Password to use when logging into ACR'
    required: true
  acr-registry-url:
    description: 'The url of the ACR registry to fetch credentials from. This should matchup with the image names.'
    required: false
    default: 'tignis.azurecr.io'
  pip-extra-index-url:
    description: 'The PIP_EXTRA_INDEX_URL to include as a secret in the docker build. Required to pull private pip packages.'
    required: false
    default: ''
  uv-index-url:
    description: 'The UV index URL to include as a secret in the docker build. Required for UV-based builds with private packages.'
    required: false
    default: ''
  push:
    description: 'Also push the image to the remote repository'
    required: false
    default: 'true'
  docker-build-context:
    description: 'Build context for docker if not the current directory'
    required: false
    default: '.'
  dockerfile:
    description: 'Name of the docker file to use'
    required: false
    default: 'Dockerfile'
  platforms:
    description: 'Comma separated list of platforms to use for docker build'
    required: false
    default: 'linux/amd64,linux/arm64'
  tag-prefix:
    description: 'Prefix to add to generated docker tag'
    required: false
    default: ''
  GITHUB_TOKEN:
    description: 'Github token of the repository (automatically created by Github)'
    default: ${{ github.token }}
    required: false
  depot-token:
    description: 'Depot token for authentication (optional, enables Depot builds)'
    required: false
    default: ''
  depot-project:
    description: 'Depot project ID (optional, required if using Depot)'
    required: false
    default: ''
  target:
    description: 'Target build stage (optional, for multi-stage builds)'
    required: false
    default: ''
outputs:
  tag: # id of output
    description: 'Tag used for the docker image'
    value: ${{ steps.meta.outputs.tags }}
runs:
  using: "composite"
  steps:
    - name: Get build info
      run: |
        echo "DATE=$(date -u +%F)" >> $GITHUB_ENV
        echo "BRANCH_NAME=${GITHUB_REF#refs/heads/}" >> $GITHUB_ENV
      shell: bash
    - name: Get build info pull request
      run: |
        echo "BRANCH_NAME=${{github.head_ref}}" >> $GITHUB_ENV
      if: ${{ startsWith(github.event_name, 'pull_request') }}
      shell: bash
    - name: Docker meta
      id: meta
      uses: docker/metadata-action@v5
      with:
        # list of Docker images to use as base name for tags
        images: ${{ inputs.images }}
        flavor: |
          latest=false
        # generate Docker tags based on the following events/attributes
        tags: |
          type=sha,prefix=${{inputs.tag-prefix}}${{env.BRANCH_NAME}}-${{env.DATE}}-${{github.run_number}}-,enable=${{ !startsWith(github.event_name, 'release') }}
          type=semver,pattern=${{inputs.tag-prefix}}{{version}},enable=${{ startsWith(github.event_name, 'release') }}
    - name: Set up Depot CLI
      uses: depot/setup-action@v1
      if: ${{ inputs.depot-token != '' }}
    - name: Set up Docker Context for Buildx
      id: buildx-context
      run: |
        docker context create builders
      shell: bash
      if: ${{ inputs.depot-token == '' }}
    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3
      with:
        endpoint: builders
      if: ${{ inputs.depot-token == '' }}
    - name: Login to ACR
      uses: docker/login-action@v3
      with:
        registry: ${{ inputs.acr-registry-url }}
        username: ${{ inputs.acr-username }}
        password: ${{ inputs.acr-password }}
    - name: Login to tignis ACR
      uses: docker/login-action@v3
      with:
        registry: 'tignis.azurecr.io'
        username: ${{ inputs.acr-username }}
        password: ${{ inputs.acr-password }}
    - name: Create build secrets
      run: |
        mkdir -p /tmp/build-secrets

        # Create pip config
        cat > /tmp/build-secrets/pipconf << EOF
        [global]
        extra-index-url = ${{ inputs.pip-extra-index-url }}
        EOF

        # Create UV config if UV index URL is provided
        if [ -n "${{ inputs.uv-index-url }}" ]; then
          cat > /tmp/build-secrets/uvconfig.toml << EOF
        [[index]]
        url = "${{ inputs.uv-index-url }}"

        [[index]]
        url = "https://pypi.org/simple"
        EOF
        else
          # Create empty file if not using UV
          touch /tmp/build-secrets/uvconfig.toml
        fi
      shell: bash
    - name: Build and push with Depot
      id: docker_build_depot
      if: ${{ inputs.depot-token != '' }}
      uses: depot/build-push-action@v1
      with:
        context: ${{ inputs.docker-build-context }}
        push: ${{ inputs.push }}
        tags: ${{ steps.meta.outputs.tags }}
        labels: ${{ steps.meta.outputs.labels }}
        platforms: ${{inputs.platforms}}
        secret-files: |
          pipconf=/tmp/build-secrets/pipconf
          uvconfig=/tmp/build-secrets/uvconfig.toml
        file: ${{ inputs.dockerfile }}
        target: ${{ inputs.target }}
        token: ${{ inputs.depot-token }}
        project: ${{ inputs.depot-project }}
    - name: Build and push with Docker (AMD64 only fallback)
      id: docker_build_standard
      if: ${{ inputs.depot-token == '' }}
      uses: docker/build-push-action@v6
      with:
        context: ${{ inputs.docker-build-context }}
        push: ${{ inputs.push }}
        tags: ${{ steps.meta.outputs.tags }}
        labels: ${{ steps.meta.outputs.labels }}
        platforms: linux/amd64
        secret-files: |
          pipconf=/tmp/build-secrets/pipconf
          uvconfig=/tmp/build-secrets/uvconfig.toml
        file: ${{ inputs.dockerfile }}
        target: ${{ inputs.target }}
    - name: Image digest
      run: echo ${{ steps.docker_build_depot.outputs.digest || steps.docker_build_standard.outputs.digest }}
      shell: bash
    - name: Comment latest docker image
      if: github.event_name == 'pull_request'
      shell: bash
      run: |
        # Use GitHub API to create a comment on the PR
        PR_NUMBER=${{ github.event.pull_request.number }}
        COMMENT='Docker image built: `${{ steps.meta.outputs.tags }}`'
        GITHUB_TOKEN=${{ inputs.GITHUB_TOKEN }}
        COMMENT_URL="https://api.github.com/repos/${{ github.repository }}/issues/${PR_NUMBER}/comments"

        curl -s -H "Authorization: token ${GITHUB_TOKEN}" -X POST $COMMENT_URL -d "{\"body\":\"${COMMENT}\"}"