build-docker.yml

name: Build Docker image

on:
  workflow_call:
    inputs:
      tags:
        description: "List of tags as key-value pair attributes"
        required: false
        type: string
      flavor:
        description: "List of flavors as key-value pair attributes"
        required: false
        type: string

env:
  GHCR_REPO: ghcr.io/defguard/defguard-proxy

jobs:
  build-docker:
    runs-on:
      - self-hosted
      - Linux
      - ${{ matrix.runner }}
    strategy:
      matrix:
        cpu: [arm64, amd64, arm/v7]
        include:
          - cpu: arm64
            runner: ARM64
            tag: arm64
          - cpu: amd64
            runner: X64
            tag: amd64
          - cpu: arm/v7
            runner: ARM
            tag: armv7
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          submodules: recursive
      - name: Login to GitHub container registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          buildkitd-config-inline: |
            [registry."docker.io"]
              mirrors = ["dockerhub-proxy.teonite.net"]
      - name: Build container
        uses: docker/build-push-action@v5
        with:
          context: .
          platforms: linux/${{ matrix.cpu }}
          provenance: false
          push: true
          tags: "${{ env.GHCR_REPO }}:${{ github.sha }}-${{ matrix.tag }}"
          cache-from: type=gha
          cache-to: type=gha,mode=max

  docker-manifest:
    runs-on: [self-hosted, Linux]
    needs: [build-docker]
    steps:
      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: |
            ${{ env.GHCR_REPO }}
          flavor: ${{ inputs.flavor }}
          tags: ${{ inputs.tags }}
      - name: Login to GitHub container registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Create and push manifests
        run: |
          tags='${{ env.GHCR_REPO }}:${{ github.sha }} ${{ steps.meta.outputs.tags }}'
          for tag in ${tags}
          do
            docker manifest rm ${tag} || true
            docker manifest create ${tag} ${{ env.GHCR_REPO }}:${{ github.sha }}-amd64 ${{ env.GHCR_REPO }}:${{ github.sha }}-arm64 ${{ env.GHCR_REPO }}:${{ github.sha }}-armv7
            docker manifest push ${tag}
          done