# This workflow builds a Docker image and uploads it to Docker hub.

#

# If the push input id false, the image is built but not uploaded.

#

# Secrets must be inherited from the caller.

#

# Based on most recent docker guide [1], with some adaptations based on

# existing FDP and FDP-client workflows.

#

# [1]: https://docs.docker.com/guides/gha/

name: Docker publish

on:

workflow_call:

# https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#onworkflow_callinputs

inputs:

# the caller can specify whether to push the image to docker hub

push:

description: 'Determines if the resulting Docker image is pushed to Docker Hub'

required: true

type: boolean

build-args:

# Example of newline-delimited string (https://github.com/docker/build-push-action?tab=readme-ov-file#inputs):

# build-args: |

# PROJECT_VERSION=1.2.3

description: 'List of Docker build arguments (--build-arg), formatted as newline-delimited string'

required: false

type: string

context:

description: 'Docker build context'

required: false

default: '.'

type: string

file:

description: 'Path to Dockerfile, e.g. "./Dockerfile"'

required: false

default: './Dockerfile'

type: string

platforms:

# https://docs.docker.com/build/building/multi-platform/

# https://docs.docker.com/reference/cli/docker/buildx/build/#platform

description: 'Multi-platform builds'

required: false

default: linux/amd64,linux/arm64

type: string

jobs:

build:

runs-on: ubuntu-latest

steps:

- # https://github.com/actions/checkout

name: Clone git repo

uses: actions/checkout@v6

- # https://github.com/docker/metadata-action

name: Extract git metadata for Docker image

id: meta

uses: docker/metadata-action@v5

with:

# e.g. fairdata/fairdatapoint

images: |

${{ vars.DOCKER_HUB_NAMESPACE }}/${{ vars.DOCKER_IMAGE_NAME }}

# `latest` tag is generated by default

tags: |

type=ref,event=branch

type=ref,event=pr

type=semver,pattern={{version}}

type=semver,pattern={{major}}.{{minor}}

type=semver,pattern={{major}},enable=${{ !startsWith(github.ref, 'refs/tags/v0.') }}

- # https://github.com/docker/login-action

name: Log in to Docker Hub

if: inputs.push

uses: docker/login-action@v3

with:

username: ${{ vars.DOCKER_HUB_USERNAME }}

password: ${{ secrets.DOCKER_HUB_PASSWORD }}

- # https://github.com/docker/setup-qemu-action

# for multi-platform builds

name: Set up QEMU

uses: docker/setup-qemu-action@v3

- # https://github.com/docker/setup-buildx-action

# recommended by build-push-action

# for multi-platform builds, provenance, sbom, and more

name: Set up Docker Buildx

uses: docker/setup-buildx-action@v3

- # https://github.com/docker/build-push-action

name: Build and push Docker image

uses: docker/build-push-action@v6

with:

# https://github.com/docker/build-push-action?tab=readme-ov-file#inputs

build-args: ${{ inputs.build-args }}

context: ${{ inputs.context }}

# https://docs.docker.com/build/concepts/dockerfile/#filename

file: ${{ inputs.file }}

platforms: ${{ inputs.platforms }}

push: ${{ inputs.push }}

tags: ${{ steps.meta.outputs.tags }}

# https://docs.docker.com/build/metadata/annotations/

annotations: ${{ steps.meta.outputs.annotations }}

provenance: true

sbom: true