universal-resolver/.github/workflows/docker-multi-arch.yml at main · TxnLab/universal-resolver · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
name: Docker Multi-Arch

on:
  workflow_call:
    inputs:
      GLOBAL_FRAMEWORK:
        required: false
        type: string
        default: maven
        description: Framework used for the build (e.g., maven, node, nodejs, etc.)
      GLOBAL_IMAGE_NAME:
        required: true
        type: string
      GLOBAL_REPO_NAME:
        type: string
        default: docker.io
      IMAGE_TAG:
        required: false
        type: string
      IS_RELEASE:
        required: false
        type: boolean
        default: false
      PATH_TO_DOCKERFILE:
        required: true
        type: string
      RELEASE_TYPE:
        required: false
        type: string
        default: minor
        description: Type of release - Major, Minor, or Patch
    secrets:
      CI_SECRET_READER_PERIODIC_TOKEN:
        required: true
      VAULT_ADDR:
        required: true
      VAULTCA:
        required: true

jobs:
  docker-build:
    name: Docker Build
    runs-on: ${{ matrix.runs-on }}

    strategy:
      matrix:
        arch: [amd64, arm64]
        include:
          - arch: amd64
            runs-on: ubuntu-24.04
          - arch: arm64
            runs-on: ubuntu-24.04-arm

    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Import Secrets
        uses: hashicorp/vault-action@v3
        with:
          url: ${{ secrets.VAULT_ADDR }}
          token: ${{ secrets.CI_SECRET_READER_PERIODIC_TOKEN }}
          caCertificate: ${{ secrets.VAULTCA }}
          secrets: |
            ci/data/gh-workflows/maven-danubetech-nexus username | MAVEN_USERNAME ;
            ci/data/gh-workflows/maven-danubetech-nexus password | MAVEN_PASSWORD

      - name: Setup Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          install: true
          version: latest

      - name: Docker Build and Cache
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ${{ inputs.PATH_TO_DOCKERFILE }}
          push: false
          build-args: |
            DANUBETECH_MAVEN_INTERNAL_USERNAME=${{ env.MAVEN_USERNAME }}
            DANUBETECH_MAVEN_INTERNAL_PASSWORD=${{ env.MAVEN_PASSWORD }}
          cache-from: type=gha,scope=docker-build-${{ matrix.arch }}
          cache-to: type=gha,scope=docker-build-${{ matrix.arch }},mode=max
          platforms: linux/${{ matrix.arch }}

  docker-publish:
    name: Docker Publish
    runs-on: ubuntu-24.04
    needs: docker-build

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          persist-credentials: false
          fetch-depth: 0

      - name: Import Secrets
        uses: hashicorp/vault-action@v3
        with:
          url: ${{ secrets.VAULT_ADDR }}
          token: ${{ secrets.CI_SECRET_READER_PERIODIC_TOKEN }}
          caCertificate: ${{ secrets.VAULTCA }}
          secrets: |
            ci/data/gh-workflows/${{ inputs.GLOBAL_REPO_NAME }} username | DOCKER_USERNAME ;
            ci/data/gh-workflows/${{ inputs.GLOBAL_REPO_NAME }} password | DOCKER_PASSWORD ;
            ci/data/gh-workflows/maven-danubetech-nexus username | MAVEN_USERNAME ;
            ci/data/gh-workflows/maven-danubetech-nexus password | MAVEN_PASSWORD

      - name: Setup Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          install: true
          version: latest

      - name: Get version
        if: inputs.IS_RELEASE
        id: get_version
        run: echo "version=$(git describe --abbrev=0)" >> $GITHUB_OUTPUT

      - name: Docker Metadata
        id: metadata
        uses: docker/metadata-action@v5
        with:
          images: ${{ inputs.GLOBAL_REPO_NAME }}/${{ inputs.GLOBAL_IMAGE_NAME }}
          tags: |
            type=raw,value=${{ inputs.IMAGE_TAG }},enable=${{ inputs.IMAGE_TAG != '' }}
            type=sha,prefix=${{ steps.get_version.outputs.version }}-,enable=${{ inputs.IS_RELEASE }}

      - name: Login to Docker Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ inputs.GLOBAL_REPO_NAME }}
          username: ${{ env.DOCKER_USERNAME }}
          password: ${{ env.DOCKER_PASSWORD }}

      - name: Docker Push
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ${{ inputs.PATH_TO_DOCKERFILE }}
          push: true
          tags: ${{ steps.metadata.outputs.tags }}
          labels: ${{ steps.metadata.outputs.labels }}
          build-args: |
            DANUBETECH_MAVEN_INTERNAL_USERNAME=${{ env.MAVEN_USERNAME }}
            DANUBETECH_MAVEN_INTERNAL_PASSWORD=${{ env.MAVEN_PASSWORD }}
          cache-from: |
            type=gha,scope=docker-build-arm64
            type=gha,scope=docker-build-amd64
          platforms: linux/amd64,linux/arm64