action.yml

name: Conditional Container Builder with Fallback
description: Build if trigger conditions are met, else use fallback image
branding:
  icon: package
  color: blue

inputs:
  ### Required
  package:
    description: Package name; e.g. backend, frontend
    required: true
  tag:
    description: Default tag; e.g. pr#, test, prod
    required: true

  ### Typical / recommended
  tag_fallback:
    description: Where to pull default images from; e.g. prod, test
  triggers:
    description: Paths used to trigger a build; e.g. ('./backend/' './frontend/)
  build_context:
    description: Build context, not required for self-contained package/default directory
  build_file:
    description: Dockerfile with path, not required for self-contained package/default directory
  keep_versions:
    description: Number of versions to keep; omit to skip

  ### Usually a bad idea / not recommended
  build_args:
    description: A list of build-time variables, generally not advisable
    value: "BUILDKIT_INLINE_CACHE=1"
  diff_branch:
    description: Branch to diff against
    default: ${{ github.event.repository.default_branch }}
  keep_regex:
    description: Regex for tags to skip when keep_versions is provided; defaults to test and prod
    default: "^(prod|test|latest)$"
  repository:
    description: Non-default repo to clone
    default: ${{ github.repository }}
  token:
    description: Specify token (GH or PAT), instead of inheriting one from the calling workflow
    default: ${{ github.token }}

outputs:
  digest:
    description: 'Digest of the built image; e.g. sha256:1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef'
    value: ${{ steps.digest_new.outputs.digest }}

  digest_old:
    description: 'Digest of the previous image, if one existed'
    value: ${{ steps.digest_old.outputs.digest }}

  triggered:
    description: Did a deployment trigger?  [true|false]
    value: ${{ steps.diff.outputs.triggered }}

runs:
  using: composite
  steps:
    # Cleanup if inputs.keep_versions provided
    - name: GHCR Cleanup
      if: ${{ inputs.keep_versions }}
      uses: actions/delete-package-versions@v5.0.0
      with:
        package-name: "${{ github.event.repository.name }}/${{ inputs.package }}"
        package-type: "container"
        min-versions-to-keep: ${{ inputs.keep_versions }}
        ignore-versions: "${{ inputs.keep_regex }}"

    # Process variables and inputs
    - id: vars
      shell: bash
      run: |
        # Inputs and variables

        # Use package folder as build_context unless an override has been provided
        if [ -z ${{ inputs.build_context }} ]; then
          BUILD_CONTEXT=${{ inputs.package }}
        else
          BUILD_CONTEXT=${{ inputs.build_context }}
        fi
        echo "build_context=${BUILD_CONTEXT}" >> $GITHUB_OUTPUT

        # Use BUILD_CONTEXT/Dockerfile as build_file unless an override has been provided
        if [ -z ${{ inputs.build_file }} ]; then
          BUILD_FILE=${BUILD_CONTEXT}/Dockerfile
        else
          BUILD_FILE=${{ inputs.build_file }}
        fi
        echo "build_file=${BUILD_FILE}" >> $GITHUB_OUTPUT

        # Bug - Docker build hates images with capital letters
        TAGS=$( echo "ghcr.io/${{ github.repository }}/${{ inputs.package }}:${{ inputs.tag }}" | tr '[:upper:]' '[:lower:]' )
        echo "tags=${TAGS//[$'\r\n ']}" >> $GITHUB_OUTPUT

    # Send triggers to diff action
    - id: diff
      uses: bcgov-nr/action-diff-triggers@v0.2.0
      with:
        triggers: ${{ inputs.triggers }}
        diff_branch: ${{ inputs.diff_branch }}

    # Check if a build is required (steps.build.outputs.triggered=true|false)
    - name: Check for builds
      env:
        URL_FALLBACK: ghcr.io/${{ inputs.repository }}/${{ inputs.package }}:${{ inputs.tag_fallback }}
      id: build
      shell: bash
      run: |
        # Check for builds
        echo "triggered=true" >> $GITHUB_OUTPUT
        if [ "${{ steps.diff.outputs.triggered }}" == "true" ]; then
          echo "Build triggered. Used bcgov-nr/action-diff-triggers."
        elif [ "${{ inputs.repository }}" != "${{ github.repository }}" ]; then
          echo "Build triggered.  Override repository provided."
        elif [ -z "${{ inputs.tag_fallback }}" ]; then
          echo "Build triggered.  No tag_fallback provided."
        elif [[ ! $(docker manifest inspect ${URL_FALLBACK}) ]]; then
          echo "Build triggered.  Fallback tag (tag_fallback) not usable."
        else
          echo "Container build not required"
          echo "triggered=false" >> $GITHUB_OUTPUT
        fi

    # If a build is not required, reuse a previous image
    - name: Recycle/retag Previous Images
      uses: shrink/actions-docker-registry-tag@v4
      if: steps.build.outputs.triggered != 'true'
      with:
        registry: ghcr.io
        repository: ${{ inputs.repository }}/${{ inputs.package }}
        target: ${{ inputs.tag_fallback }}
        tags: ${{ inputs.tag }}

    # If a build is required and replaces a previous image, save its SHA
    - name: Check for a previous SHA
      id: digest_old
      shell: bash
      run: |
        DIGEST=$((docker manifest inspect ${{ steps.vars.outputs.tags }} || echo )| jq -r '.manifests[0].digest')
        echo "digest=${DIGEST}" >> $GITHUB_OUTPUT

    # If a build is required, then checkout, login, build and push!
    - uses: actions/checkout@v4
      with:
        repository: ${{ inputs.repository }}

    - name: Add build envars to Dockerfile
      if: steps.build.outputs.triggered == 'true'
      env:
        dockerfile: ${{ steps.vars.outputs.build_file }}
      shell: bash
      run: |
        # Add build envars to Dockerfile
        echo "ENV BUILDER_IMAGE=ghcr.io/${{ github.repository }}/${{ inputs.package }}:${{ inputs.tag }}" >> ${{ env.dockerfile }}
        echo "ENV BUILDER_PACKAGE=${{ inputs.package }}" >> ${{ env.dockerfile }}
        echo "ENV BUILDER_REPO=${{ github.repository }}" >> ${{ env.dockerfile }}
        echo "ENV BUILDER_TAG=${{ inputs.tag }}" >> ${{ env.dockerfile }}

    - name: Set up Docker Buildx
      if: steps.build.outputs.triggered == 'true'
      uses: docker/setup-buildx-action@v3

    - name: Log in to the Container registry
      if: steps.build.outputs.triggered == 'true'
      uses: docker/login-action@v3
      with:
        registry: ghcr.io
        username: ${{ github.actor }}
        password: ${{ inputs.token }} 

    - name: Build and push ${{ inputs.package }} Docker image
      if: steps.build.outputs.triggered == 'true'
      uses: docker/build-push-action@v6
      with:
        context: ${{ steps.vars.outputs.build_context }}
        file: ${{ steps.vars.outputs.build_file }}
        push: true
        tags: ${{ steps.vars.outputs.tags }}
        cache-from: type=gha
        cache-to: type=gha,mode=max
        build-args: ${{ inputs.build_args }}

    # Action repo needs to be present for cleanup/tests
    - name: Checkout local repo to make sure action.yml is present
      if: ${{ github.repository }} != ${{ inputs.repository }}
      uses: actions/checkout@v4

    # Get the digest of the built image
    - name: Return digest of the built image
      id: digest_new
      shell: bash
      run: |
        DIGEST=$(docker manifest inspect ${{ steps.vars.outputs.tags }} | jq -r '.manifests[0].digest')
        echo "digest=${DIGEST}" >> $GITHUB_OUTPUT

    - shell: bash
      run: |
        # Summary
        echo "digest_new: ${{ steps.digest_new.outputs.digest }}"
        echo "digest_old: ${{ steps.digest_old.outputs.digest }}"
        echo "triggered: ${{ steps.diff.outputs.triggered }}"