_containerTemplate.yml

name: Container Template

on:
  workflow_call:
    inputs:
      environment:
        required: true
        type: string
        default: "dev"
        description: "Specifies the environment of the deployment."
      working_directory:
        required: false
        type: string
        default: ./code/function
        description: "Specifies the uri of the container registry."
      registry_uri:
        required: false
        type: string
        default: ghcr.io
        description: "Specifies the uri of the container registry."
      image_namespace_name:
        required: true
        type: string
        description: "Specifies the namespace name of the image."
      image_name:
        required: true
        type: string
        description: "Specifies the name of the image."
    secrets:
      USER_NAME:
        required: true
        description: "Specifies the user name for the container registry."
      PASSWORD:
        required: true
        description: "Specifies the password for the container registry."

jobs:
  deployment:
    name: Container Build & Push
    runs-on: [ubuntu-latest]
    continue-on-error: false
    environment: ${{ inputs.environment }}

    permissions:
      contents: read
      packages: write
      id-token: write

    steps:
      # Check Out Repository
      - name: Check Out Repository
        id: checkout_repository
        uses: actions/checkout@v4

      # Install cosign
      - name: Install cosign
        id: install_cosign
        uses: sigstore/cosign-installer@v3.7.0
        if: github.event_name != 'pull_request'
        with:
          cosign-release: 'v2.2.0'

      # Install QEMU
      - name: Set up QEMU
        id: install_qemu
        uses: docker/setup-qemu-action@v3

      # Install BuildKit
      - name: Install Buildx
        id: install_buildx
        uses: docker/setup-buildx-action@v3.7.1

      # Login Container Registry
      - name: Login Container Registry
        id: registry_login
        uses: docker/login-action@v3.3.0
        if: github.event_name != 'pull_request'
        with:
          registry: ${{ inputs.registry_uri }}
          username: ${{ secrets.USER_NAME }}
          password: ${{ secrets.PASSWORD }}

      # Extract Metadata (tags, labels)
      - name: Extract Metadata
        id: metadata
        uses: docker/metadata-action@v5.6.1
        with:
          context: workflow
          images: |
            ${{ inputs.registry_uri }}/${{ inputs.image_namespace_name }}/${{ inputs.image_name }}
          tags: |
            type=ref,event=branch
            type=ref,event=pr
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}

      # Build and Push Docker Image with Buildx
      - name: Build and push Docker image
        id: build_push
        uses: docker/build-push-action@v6.9.0
        with:
          context: ${{ inputs.working_directory }}
          file: ${{ inputs.working_directory }}/Dockerfile
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.metadata.outputs.tags }}
          labels: ${{ steps.metadata.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      # Sign container image
      # This step uses the identity token to provision an ephemeral certificate against the sigstore community Fulcio instance.
      - name: Sign container image
        id: sign
        if: github.event_name == 'release'
        run: |
          cosign sign --yes "${TAGS}@${DIGEST}"
        env:
          TAGS: ${{ steps.metadata.outputs.tags }}
          DIGEST: ${{ steps.build_push.outputs.digest }}