action.yml

name: 'Docker and GitOps Commit'
description: 'Build and push the Docker image and commits the new version to your GitOps repo.'
author: 'Staffbase GmbH'

inputs:
  docker-registry:
    description: 'Docker Registry'
    required: true
    default: 'registry.staffbase.com'
  docker-registry-api:
    description: 'Docker Registry API'
    required: false
    default: 'https://registry.staffbase.com/v2/'
  docker-image:
    description: 'Docker Image'
    required: true
  docker-custom-tag:
    description: 'Docker Custom Tag'
    required: false
  docker-username:
    description: 'Username for the Docker Registry'
    required: false
  docker-password:
    description: 'Password for the Docker Registry'
    required: false
  docker-file:
    description: 'Path of the Dockerfile. Should be relative to input.working-directory'
    required: true
    default: './Dockerfile'
  docker-build-args:
    description: "List of build-time variables"
    required: false
  docker-build-secrets:
    description: "List of secrets to expose to the build (e.g., key=string, GIT_AUTH_TOKEN=mytoken)"
    required: false
  docker-build-secret-files:
    description: "List of secret files to expose to the build (e.g., key=filename, MY_SECRET=./secret.txt)"
    required: false
  docker-build-target:
    description: "Sets the target stage to build"
    required: false
  docker-build-platforms:
    description: "Sets the target platforms for build"
    required: false
    default: 'linux/amd64'
  docker-build-provenance:
    description: "Generate provenance attestation for the build"
    required: false
    default: 'false'
  docker-build-outputs:
    description: "Custom output destinations (e.g., type=registry,push=true,compression=zstd,force-compression=true). When set, this replaces the default push behavior - include push=true if pushing is desired."
    required: false
  docker-disable-retagging:
    description: 'Disable retagging of existing images'
    required: false
    default: 'false'
  gitops-organization:
    description: 'GitHub Organization for GitOps'
    required: true
    default: 'Staffbase'
  gitops-repository:
    description: 'GitHub Repository for GitOps'
    required: true
    default: 'mops'
  gitops-user:
    description: 'GitHub User for GitOps'
    required: true
    default: 'Staffbot'
  gitops-email:
    description: 'GitHub User for GitOps'
    required: true
    default: 'staffbot@staffbase.com'
  gitops-token:
    description: 'GitHub Token for GitOps'
    required: false
  gitops-dev:
    description: 'Files which should be updated by the GitHub Action for DEV'
    required: false
  gitops-stage:
    description: 'Files which should be updated by the GitHub Action for STAGE'
    required: false
  gitops-prod:
    description: 'Files which should be updated by the GitHub Action for PROD'
    required: false
  upwind-client-id:
    description: 'Upwind Client ID'
    required: false
  upwind-organization-id:
    description: 'Upwind Organization ID'
    required: false
  upwind-client-secret:
    description: 'Upwind Client Secret'
    required: false
  working-directory:
    description: 'The path relative to the repo root dir in which the GitOps action should be executed.'
    required: false
    default: '.'

outputs:
  docker-tag:
    description: 'Docker tag'
    value: ${{ steps.preparation.outputs.tag }}
  docker-digest:
    description: 'Docker digest'
    value: ${{ steps.docker_build.outputs.digest || steps.docker_retag.outputs.digest }}

runs:
  using: "composite"
  steps:
    - name: Generate Tags
      id: preparation
      shell: bash
      run: |
        BUILD="true"
        if [[ -n "${{ inputs.docker-custom-tag }}" ]]; then
          TAG="${{ inputs.docker-custom-tag }}"
          LATEST="latest"
          PUSH="true"
          BUILD="${{ inputs.docker-disable-retagging }}"
        elif [[ $GITHUB_REF == refs/heads/master ]]; then
          TAG="master-${GITHUB_SHA::8}"
          LATEST="master"
          PUSH="true"
        elif [[ $GITHUB_REF == refs/heads/main ]]; then
          TAG="main-${GITHUB_SHA::8}"
          LATEST="main"
          PUSH="true"
        elif [[ $GITHUB_REF == refs/heads/dev ]]; then
          TAG="dev-${GITHUB_SHA::8}"
          LATEST="dev"
          PUSH="true"
        elif [[ $GITHUB_REF == refs/tags/v* ]]; then
          TAG="${GITHUB_REF:11}"
          LATEST="latest"
          PUSH="true"
          BUILD="${{ inputs.docker-disable-retagging }}"
        elif [[ $GITHUB_REF == refs/tags/* ]]; then
          TAG="${GITHUB_REF:10}"
          LATEST="latest"
          PUSH="true"
          BUILD="${{ inputs.docker-disable-retagging }}"
        else
          TAG="${GITHUB_SHA::8}"
          PUSH="false"
        fi

        TAG_LIST="${{ inputs.docker-registry }}/${{ inputs.docker-image }}:${TAG}"
        if [[ ! -z "${LATEST}" ]]; then
          TAG_LIST+=",${{ inputs.docker-registry }}/${{ inputs.docker-image }}:${LATEST}"
        fi

        echo "build=$BUILD" >> $GITHUB_OUTPUT
        echo "latest=$LATEST" >> $GITHUB_OUTPUT
        echo "push=$PUSH" >> $GITHUB_OUTPUT
        echo "tag=$TAG" >> $GITHUB_OUTPUT
        echo "tag_list=$TAG_LIST" >> $GITHUB_OUTPUT

    - name: Verify Architecture Match
      shell: bash
      if: steps.preparation.outputs.build == 'true'
      run: |
        RUNNER_ARCH="${{ runner.arch }}" # X64 (AMD64) or ARM64
        TARGET_PLATFORMS="${{ inputs.docker-build-platforms }}"
        
        echo "Runner CPU Architecture: $RUNNER_ARCH"
        echo "Requested Build Platforms: $TARGET_PLATFORMS"

        # Check for AMD64 mismatch (Runner is X64, but user requests ONLY arm64, OR user requests multi-arch which requires emulation)
        if [[ "$RUNNER_ARCH" == "X64" ]]; then
          if [[ "$TARGET_PLATFORMS" == *"linux/arm64"* ]]; then
            echo "::error::Runner is X64 (Intel/AMD) but build includes 'linux/arm64'. This requires emulation. Aborting strictly."
            exit 1
          fi
        fi

        # Check for ARM64 mismatch
        if [[ "$RUNNER_ARCH" == "ARM64" ]]; then
          if [[ "$TARGET_PLATFORMS" == *"linux/amd64"* ]]; then
            echo "::error::Runner is ARM64 (Apple Silicon/Graviton) but build includes 'linux/amd64'. This requires emulation. Aborting strictly."
            exit 1
          fi
        fi
        
        echo "Architecture match verified for native build ✅"

    - name: Set up Docker Buildx
      if: inputs.docker-username != '' && inputs.docker-password != ''
      uses: docker/setup-buildx-action@v3

    - name: Login to Registry
      if: inputs.docker-username != '' && inputs.docker-password != ''
      uses: docker/login-action@v3
      with:
        registry: ${{ inputs.docker-registry }}
        username: ${{ inputs.docker-username }}
        password: ${{ inputs.docker-password }}


    - name: Build
      id: docker_build
      if: steps.preparation.outputs.build == 'true' && inputs.docker-username != '' && inputs.docker-password != ''
      uses: docker/build-push-action@v6
      with:
        context: ${{ inputs.working-directory }}
        push: ${{ inputs.docker-build-outputs == '' && steps.preparation.outputs.push || 'false' }}
        file: ${{ inputs.working-directory }}/${{ inputs.docker-file }}
        target: ${{ inputs.docker-build-target }}
        build-args: ${{ inputs.docker-build-args }}
        tags: ${{ steps.preparation.outputs.tag_list }}
        secrets: ${{ inputs.docker-build-secrets }}
        secret-files: ${{ inputs.docker-build-secret-files }}
        platforms: ${{ inputs.docker-build-platforms }}
        cache-from: type=gha
        cache-to: type=gha,mode=max
        provenance: ${{ inputs.docker-build-provenance }}
        outputs: ${{ inputs.docker-build-outputs }}

    - name: Retag Existing Image
      id: docker_retag
      if: steps.preparation.outputs.build == 'false'
      shell: bash
      run: |
        CHECK_EXISTING_TAGS="master-${GITHUB_SHA::8} main-${GITHUB_SHA::8}"
        # Accept both single-arch manifests and multi-arch manifest lists/indexes
        ACCEPT_HEADER="application/vnd.docker.distribution.manifest.v2+json, application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.oci.image.manifest.v1+json, application/vnd.oci.image.index.v1+json"

        echo "CHECK_EXISTING_TAGS: ${CHECK_EXISTING_TAGS}"
        echo "RELEASE_TAG: ${RELEASE_TAG:1}"
        echo "Check if an image already exists for ${{ inputs.docker-image }}:main|master-${GITHUB_SHA::8} 🐋 ⬇"

        foundImage=false
        DETECTED_CONTENT_TYPE=""
        DIGEST=""

        end=$((SECONDS+300))
        while [ $SECONDS -lt $end ]; do

          MANIFEST=""
          for tag in $CHECK_EXISTING_TAGS; do
            # Dump headers to file to extract Content-Type and Digest later
            MANIFEST=$(curl -s -D headers.txt -H "Accept: ${ACCEPT_HEADER}" -u '${{ inputs.docker-username }}:${{ inputs.docker-password }}' "${{ inputs.docker-registry-api }}${{ inputs.docker-image}}/manifests/${tag}")

            if [[ $MANIFEST == *"errors"* ]]; then
              echo "No image found for ${{ inputs.docker-image }}:${tag} 🚫"
              continue
            else
              echo "Image found for ${{ inputs.docker-image }}:${tag} 🐋 ⬇"
              foundImage=true
        
              # Extract the Content-Type returned by registry
              DETECTED_CONTENT_TYPE=$(grep -i "^Content-Type:" headers.txt | cut -d' ' -f2 | tr -d '\r')
        
              # Extract the correct digest from headers (works for lists and single images)
              DIGEST=$(grep -i "^Docker-Content-Digest:" headers.txt | cut -d' ' -f2 | tr -d '\r')
        
              break 2
            fi
          done

          sleep 10
        done

        if [[ $foundImage == false ]]; then
          echo "No image found for ${{ inputs.docker-image }}:main|master-${GITHUB_SHA::8} 🚫 within 300 seconds"
          exit 1
        fi

        echo "Retagging image with release version and :latest tags for ${{ inputs.docker-image }} 🏷"
        echo "Using Content-Type: ${DETECTED_CONTENT_TYPE}"
        
        # Use the detected Content-Type to PUT the manifest back
        curl --fail-with-body -X PUT -H "Content-Type: ${DETECTED_CONTENT_TYPE}" -u '${{ inputs.docker-username }}:${{ inputs.docker-password }}' -d "${MANIFEST}" "${{ inputs.docker-registry-api }}${{ inputs.docker-image}}/manifests/${{ steps.preparation.outputs.tag }}"
        curl --fail-with-body -X PUT -H "Content-Type: ${DETECTED_CONTENT_TYPE}" -u '${{ inputs.docker-username }}:${{ inputs.docker-password }}' -d "${MANIFEST}" "${{ inputs.docker-registry-api }}${{ inputs.docker-image}}/manifests/${{ steps.preparation.outputs.latest }}"

        echo "digest=$DIGEST" >> $GITHUB_OUTPUT

    - name: Checkout GitOps Repository
      if: inputs.gitops-token != ''
      uses: actions/checkout@v6
      with:
        repository: ${{ inputs.gitops-organization }}/${{ inputs.gitops-repository }}
        token: ${{ inputs.gitops-token }}
        path: .github/${{ inputs.gitops-repository }}

    - name: Update Docker Image in Repository
      if: inputs.gitops-token != ''
      working-directory: .github/${{ inputs.gitops-repository }}
      shell: bash
      run: |
        push_to_gitops_repo () {
          # In case there was another push in the meantime, we pull it again
          git pull --rebase https://${{ inputs.gitops-user }}:${{ inputs.gitops-token }}@github.com/${{ inputs.gitops-organization }}/${{ inputs.gitops-repository }}.git
          git push https://${{ inputs.gitops-user }}:${{ inputs.gitops-token }}@github.com/${{ inputs.gitops-organization }}/${{ inputs.gitops-repository }}.git
        }

        commit_changes () {
          if [[ ${{ steps.preparation.outputs.push }} == "true" ]]; then
            git add .

            # commit with no errors if there are no changes
            if git diff-index --quiet HEAD; then
              echo "There were no changes..."
              return
            fi

            git commit -m "Release ${{ inputs.docker-registry }}/${{ inputs.docker-image }}:${{ steps.preparation.outputs.tag }}"

            # retry push attempt since rejections can still happen (even with pull before push)
            push_to_gitops_repo || push_to_gitops_repo || push_to_gitops_repo
          fi
        }

        # configure git user
        git config --global user.email "${{ inputs.gitops-email }}" && git config --global user.name "${{ inputs.gitops-user }}"

        if [[ ( $GITHUB_REF == refs/heads/master || $GITHUB_REF == refs/heads/main ) && -n "${{ inputs.gitops-stage }}" ]]; then
          echo "Run update for STAGE"
          while IFS= read -r line; do
            array=($line)
            echo "Check if path $line exists and get old current version"
            yq -e .${array[1]} ${array[0]}
            echo "Run update $line ${{ inputs.docker-registry }}/${{ inputs.docker-image }}:${{ steps.preparation.outputs.tag }}"
            yq -i .${array[1]}=\"${{ inputs.docker-registry }}/${{ inputs.docker-image }}:${{ steps.preparation.outputs.tag }}\" ${array[0]}
          done <<< "${{ inputs.gitops-stage }}"
          commit_changes

        elif [[ $GITHUB_REF == refs/heads/dev && -n "${{ inputs.gitops-dev }}" ]]; then
          echo "Run update for DEV"
          while IFS= read -r line; do
            array=($line)
            echo "Check if path $line exists and get old current version"
            yq -e .${array[1]} ${array[0]}
            echo "Run update $line ${{ inputs.docker-registry }}/${{ inputs.docker-image }}:${{ steps.preparation.outputs.tag }}"
            yq -i .${array[1]}=\"${{ inputs.docker-registry }}/${{ inputs.docker-image }}:${{ steps.preparation.outputs.tag }}\" ${array[0]}
          done <<< "${{ inputs.gitops-dev }}"
          commit_changes

        elif [[ $GITHUB_REF == refs/tags/* && -n "${{ inputs.gitops-prod }}" ]]; then
          echo "Run update for PROD"
          while IFS= read -r line; do
            array=($line)
            echo "Check if path $line exists and get old current version"
            yq -e .${array[1]} ${array[0]}
            echo "Run update $line ${{ inputs.docker-registry }}/${{ inputs.docker-image }}:${{ steps.preparation.outputs.tag }}"
            yq -i .${array[1]}=\"${{ inputs.docker-registry }}/${{ inputs.docker-image }}:${{ steps.preparation.outputs.tag }}\" ${array[0]}
          done <<< "${{ inputs.gitops-prod }}"
          commit_changes

        elif [[ -n "${{ inputs.gitops-dev }}" ]]; then
          echo "Simulate update for DEV"
          while IFS= read -r line; do
            array=($line)
            echo "Check if path $line exists and get old current version"
            yq -e .${array[1]} ${array[0]}
            echo "Run update $line ${{ inputs.docker-registry }}/${{ inputs.docker-image }}:${{ steps.preparation.outputs.tag }}"
            yq -i .${array[1]}=\"${{ inputs.docker-registry }}/${{ inputs.docker-image }}:${{ steps.preparation.outputs.tag }}\" ${array[0]}
          done <<< "${{ inputs.gitops-dev }}"
        fi

    - name: Emit Image Build Event to Upwind.io
      env:
        UPWIND_CLIENT_SECRET: ${{ inputs.upwind-client-secret }}
      if: "${{ inputs.upwind-client-id != '' && env.UPWIND_CLIENT_SECRET != '' && inputs.upwind-organization-id != '' }}"
      uses: upwindsecurity/create-image-build-event-action@v3
      continue-on-error: true
      with:
        image: ${{ inputs.docker-image }}
        image_sha: ${{ steps.docker_build.outputs.digest || steps.docker_retag.outputs.digest }}
        upwind_client_id: ${{ inputs.upwind-client-id }}
        upwind_client_secret: ${{ env.UPWIND_CLIENT_SECRET }}
        upwind_organization_id: ${{ inputs.upwind-organization-id }}

branding:
  icon: 'git-merge'
  color: 'blue'