|
| 1 | +name: Build Docker Image |
| 2 | +description: Builds and pushes the app image for a Control Plane workload |
| 3 | + |
| 4 | +inputs: |
| 5 | + app_name: |
| 6 | + description: Name of the application |
| 7 | + required: true |
| 8 | + org: |
| 9 | + description: Control Plane organization name |
| 10 | + required: true |
| 11 | + commit: |
| 12 | + description: Commit SHA to tag the image with |
| 13 | + required: true |
| 14 | + pr_number: |
| 15 | + description: Pull request number for status messaging |
| 16 | + required: false |
| 17 | + docker_build_extra_args: |
| 18 | + description: Optional newline-delimited extra docker build tokens. Use key=value forms like --build-arg=FOO=bar. |
| 19 | + required: false |
| 20 | + docker_build_ssh_key: |
| 21 | + description: Optional private SSH key used for Docker builds that fetch private dependencies with RUN --mount=type=ssh |
| 22 | + required: false |
| 23 | + docker_build_ssh_known_hosts: |
| 24 | + description: Optional SSH known_hosts entries used with docker_build_ssh_key. Defaults to pinned GitHub.com host keys. |
| 25 | + required: false |
| 26 | + |
| 27 | +runs: |
| 28 | + using: composite |
| 29 | + steps: |
| 30 | + # Keep SSH key handling in a dedicated step so DOCKER_BUILD_SSH_KEY is never present |
| 31 | + # in the main build step's environment. ACTIONS_STEP_DEBUG=true dumps env before any |
| 32 | + # command runs, so keeping the key out of env there avoids even admin-triggered exposure. |
| 33 | + - name: Prepare SSH agent for Docker build |
| 34 | + if: ${{ inputs.docker_build_ssh_key != '' }} |
| 35 | + shell: bash |
| 36 | + env: |
| 37 | + # Pass the key via env so the file write is a single printf call rather than a |
| 38 | + # heredoc with a fixed terminator (a heredoc would silently truncate the key if |
| 39 | + # any line of the key value happened to match the terminator). Scope is still |
| 40 | + # this step only — the build step below does not receive DOCKER_BUILD_SSH_KEY. |
| 41 | + DOCKER_BUILD_SSH_KEY: ${{ inputs.docker_build_ssh_key }} |
| 42 | + DOCKER_BUILD_SSH_KNOWN_HOSTS: ${{ inputs.docker_build_ssh_known_hosts }} |
| 43 | + run: | |
| 44 | + set -euo pipefail |
| 45 | +
|
| 46 | + umask 077 |
| 47 | + mkdir -p ~/.ssh |
| 48 | + chmod 700 ~/.ssh |
| 49 | +
|
| 50 | + if [[ -n "${DOCKER_BUILD_SSH_KNOWN_HOSTS}" ]]; then |
| 51 | + printf '%s\n' "${DOCKER_BUILD_SSH_KNOWN_HOSTS}" > ~/.ssh/known_hosts |
| 52 | + else |
| 53 | + printf '%s\n' \ |
| 54 | + 'github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl' \ |
| 55 | + 'github.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=' \ |
| 56 | + 'github.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk=' \ |
| 57 | + > ~/.ssh/known_hosts |
| 58 | + fi |
| 59 | + chmod 600 ~/.ssh/known_hosts |
| 60 | +
|
| 61 | + printf '%s\n' "${DOCKER_BUILD_SSH_KEY}" > ~/.ssh/cpflow_build_key |
| 62 | + chmod 600 ~/.ssh/cpflow_build_key |
| 63 | +
|
| 64 | + - name: Build Docker image |
| 65 | + shell: bash |
| 66 | + env: |
| 67 | + APP_NAME: ${{ inputs.app_name }} |
| 68 | + COMMIT_SHA: ${{ inputs.commit }} |
| 69 | + CONTROL_PLANE_ORG: ${{ inputs.org }} |
| 70 | + DOCKER_BUILD_EXTRA_ARGS: ${{ inputs.docker_build_extra_args }} |
| 71 | + PR_NUMBER: ${{ inputs.pr_number }} |
| 72 | + run: | |
| 73 | + set -euo pipefail |
| 74 | +
|
| 75 | + PR_INFO="" |
| 76 | + docker_build_args=() |
| 77 | +
|
| 78 | + if [[ -n "${PR_NUMBER}" ]]; then |
| 79 | + PR_INFO=" for PR #${PR_NUMBER}" |
| 80 | + fi |
| 81 | +
|
| 82 | + if [[ -n "${DOCKER_BUILD_EXTRA_ARGS}" ]]; then |
| 83 | + while IFS= read -r arg; do |
| 84 | + arg="${arg%$'\r'}" |
| 85 | + [[ -n "${arg}" ]] || continue |
| 86 | +
|
| 87 | + if [[ "${arg}" =~ [[:space:]] ]]; then |
| 88 | + echo "docker_build_extra_args entries must be single docker-build tokens. " \ |
| 89 | + "Use key=value forms like --build-arg=FOO=bar." >&2 |
| 90 | + exit 1 |
| 91 | + fi |
| 92 | +
|
| 93 | + docker_build_args+=("${arg}") |
| 94 | + done <<< "${DOCKER_BUILD_EXTRA_ARGS}" |
| 95 | + fi |
| 96 | +
|
| 97 | + if [[ -f "${HOME}/.ssh/cpflow_build_key" ]]; then |
| 98 | + eval "$(ssh-agent -s)" |
| 99 | + trap 'ssh-agent -k >/dev/null; rm -f "${HOME}/.ssh/cpflow_build_key"' EXIT |
| 100 | + ssh-add "${HOME}/.ssh/cpflow_build_key" |
| 101 | + docker_build_args+=("--ssh=default") |
| 102 | + fi |
| 103 | +
|
| 104 | + echo "🏗️ Building Docker image${PR_INFO} (commit ${COMMIT_SHA})..." |
| 105 | + cpflow build-image -a "${APP_NAME}" --commit="${COMMIT_SHA}" --org="${CONTROL_PLANE_ORG}" "${docker_build_args[@]}" |
| 106 | + echo "✅ Docker image build successful${PR_INFO} (commit ${COMMIT_SHA})" |
0 commit comments