base-build-push-docker.yml

name: Base build push docker

on:
  workflow_call:
    inputs:
      name:
        required: true
        type: string
      context:
        required: true
        type: string
        default: .
      tag:
        required: true
        type: string
      dockerfile:
        required: true
        type: string

    secrets:
      DOCKER_USERNAME:
        required: true
      DOCKER_PASSWORD:
        required: true

jobs:
  build:
    name: Build ${{ inputs.name }}
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v2
      - name: Set up Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@v2
      - name: Cache Docker layers
        uses: actions/cache@v3
        with:
          path: /tmp/.buildx-cache
          key: ${{ runner.os }}-buildx-${{ github.sha }}
          restore-keys: |
            ${{ runner.os }}-buildx-
      - name: Build ${{ inputs.name }} image for test
        id: docker_test
        uses: docker/build-push-action@v4
        with:
          builder: ${{ steps.buildx.outputs.name }}
          context: ${{ inputs.context }}
          file: ${{ inputs.dockerfile }}
          load: true
          push: false
          tags: betagouvpdc/${{ inputs.name }}:${{ inputs.tag }}
          labels: |
            org.opencontainers.image.title=${{ inputs.name }} Image
            org.opencontainers.image.source=${{ github.event.repository.html_url }}
            org.opencontainers.image.revision=${{ github.sha }}
            org.opencontainers.image.created=${{ steps.buildx.outputs.start }}
            org.opencontainers.image.version=${{ inputs.tag }}
          cache-from: type=local,src=/tmp/.buildx-cache
          cache-to: type=local,dest=/tmp/.buildx-cache
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: betagouvpdc/${{ inputs.name }}:${{ inputs.tag }}
          format: 'template'
          template: '@/contrib/sarif.tpl'
          output: 'trivy-results.sarif'
        continue-on-error: true
      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v2
        continue-on-error: true
        with:
          sarif_file: 'trivy-results.sarif'
      - name: Login to DockerHub
        uses: docker/login-action@v2
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}
      - name: Build and push ${{ inputs.name }}
        id: docker_build
        uses: docker/build-push-action@v4
        with:
          builder: ${{ steps.buildx.outputs.name }}
          context: ${{ inputs.context }}
          file: ${{ inputs.dockerfile }}
          push: true
          tags: betagouvpdc/${{ inputs.name }}:${{ inputs.tag }}
          labels: |
            org.opencontainers.image.title=${{ inputs.name }} Image
            org.opencontainers.image.source=${{ github.event.repository.html_url }}
            org.opencontainers.image.revision=${{ github.sha }}
            org.opencontainers.image.created=${{ steps.buildx.outputs.start }}
            org.opencontainers.image.version=${{ inputs.tag }}
          cache-from: type=local,src=/tmp/.buildx-cache
          cache-to: type=local,dest=/tmp/.buildx-cache
      - run: echo ${{ steps.docker_build.outputs.digest }}