build-publish.yml

name: Build and Publish

on:
  workflow_call:
    inputs:
      version:
        description: 'The ECR tag to publish (must be tagged on the repository)'
        type: string
        required: true
      image-name:
        description: 'The name of the image to publish'
        type: string
        default: ${{ vars.IMAGE_NAME }}
      aws-region:
        description: 'The AWS region to publish to'
        type: string
        default: ${{ vars.AWS_REGION }}
      aws-role-arn:
        description: 'The ARN of the AWS role to assume for publication'
        type: string
        required: true
      run-label:
        description: 'The run label to use for the actions'
        type: string
        default: 'ubuntu-latest'

permissions:
  contents: read
  id-token: write
  packages: write

jobs:
  build-publish:
    name: Build
    runs-on: ${{ inputs.run-label }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          ref: ${{ inputs.version }}
          token: ${{ secrets.PRIVATE_SUBMODULE_ACCESS_TOKEN || github.token }}
          submodules: recursive

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ inputs.aws-role-arn }}
          aws-region: ${{ inputs.aws-region }}

      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2
        with:
          mask-password: 'true'

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
          logout: false

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: |
            ghcr.io/${{ github.repository }}
            ${{ steps.login-ecr.outputs.registry }}/${{ inputs.image-name }}
            walletconnect/${{ inputs.image-name }},enable=false
          flavor: |
            latest=auto
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=raw,value=${{ inputs.version }}
          # Tag immutability prevents usage of `latest`
          # type=raw,value=latest,enable={{is_default_branch}}

      - name: Setup Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build, tag, and push image
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max