build_multi_arch_image.yml

name: Build and push docker image
'on':
  workflow_call:
    inputs:
      tag_latest:
        required: true
        type: boolean
      docker_tag:
        required: true
        type: string
      container_name:
        required: true
        type: string
      base_folder:
        required: true
        type: string
      NO_CACHE:
        required: true
        type: boolean
      EXTRA_COMMON:
        required: false
        type: string

jobs:
  build_and_push_image:
    name: Build image for ${{ inputs.container_name }} on ${{ matrix.arch }}
    permissions:
      contents: read
      packages: write
      attestations: write
      id-token: write
    runs-on: '${{ matrix.runner }}'

    strategy:
      fail-fast: false
      matrix:
        include:
          - arch: amd64
            runner: ubuntu-22.04
          - arch: arm64
            runner: ubuntu-22.04-arm
    steps:
      - name: Free Disk Space for Docker
        uses: endersonmenezes/free-disk-space@e6ed9b02e683a3b55ed0252f1ee469ce3b39a885
        with:
          remove_android: true
          remove_dotnet: true
          remove_haskell: true
          remove_tool_cache: true
          rm_cmd: rm
          remove_packages: >-
            azure-cli google-cloud-cli microsoft-edge-stable
            google-chrome-stable firefox postgresql* temurin-* *llvm* mysql*
            dotnet-sdk-*
          remove_packages_one_command: true
      - name: Login to github container registry
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9
        with:
              registry: ghcr.io
              username: ${{github.actor}}
              password: ${{secrets.GITHUB_TOKEN}}
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          fetch-depth: 0
      - name: setup trivy
        uses: aquasecurity/setup-trivy@3fb12ec12f41e471780db15c232d5dd185dcb514
        with:
          version: v0.69.1
      - name: setup node
        uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238
        with:
          node-version-file: .tool-versions
  
      - name: make install
        run: |
          make install-node

      - name: Build container
        run: |
          echo "Building image..."
          make build-image
        env:
          ARCHITECTURE: '${{ matrix.arch }}'
          CONTAINER_NAME: '${{ inputs.container_name }}'
          MULTI_ARCH_TAG: '${{ inputs.docker_tag }}'
          BASE_VERSION_TAG: ${{ inputs.docker_tag}}
          IMAGE_TAG: "${{ inputs.docker_tag }}-${{ matrix.arch }}"
          BASE_FOLDER: "${{ inputs.base_folder }}"
          NO_CACHE: '${{ inputs.NO_CACHE }}'
      - name: Check docker vulnerabilities - json output
        run: |
          make scan-image-json
        env:
          CONTAINER_NAME: '${{ inputs.container_name }}'
          BASE_FOLDER: "${{ inputs.base_folder }}"
          IMAGE_TAG: "${{ inputs.docker_tag }}-${{ matrix.arch }}"
          EXIT_CODE: 0
          EXTRA_COMMON: "${{ inputs.extra_common }}"
      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f
        name: Upload scan results
        with:
          name: "scan_results_docker_${{ inputs.container_name }}_${{ matrix.arch }}.json"
          path: .out/scan_results_docker.json
      - name: Check docker vulnerabilities - table output
        run: |
          make scan-image
        env:
          CONTAINER_NAME: '${{ inputs.container_name }}'
          BASE_FOLDER: "${{ inputs.base_folder }}"
          IMAGE_TAG: "${{ inputs.docker_tag }}-${{ matrix.arch }}"
          EXIT_CODE: "1"
          EXTRA_COMMON: "${{ inputs.extra_common }}"
      - name: Show docker vulnerability output
        if: always()
        run: |
          echo "Scan output for ghcr.io/nhsdigital/eps-devcontainers/base:${DOCKER_TAG}-${ARCHITECTURE}"
          if [ -f .out/scan_results_docker.txt ]; then
            cat .out/scan_results_docker.txt
          fi
        env:
          ARCHITECTURE: '${{ matrix.arch }}'
          DOCKER_TAG: '${{ inputs.docker_tag }}'
      - name: Push tagged image and rebuild for github actions
        run: |
          echo "Pushing image..."
          docker push "ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:${DOCKER_TAG}-${ARCHITECTURE}"
          echo "## PUSHED IMAGE : ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:${DOCKER_TAG}-${ARCHITECTURE}" >> "$GITHUB_STEP_SUMMARY"

          echo "Rebuilding image for github actions with tag githubactions-${DOCKER_TAG}-${ARCHITECTURE}"
          make build-githubactions-image BASE_IMAGE_NAME="${CONTAINER_NAME}" BASE_IMAGE_TAG="${DOCKER_TAG}-${ARCHITECTURE}" IMAGE_TAG="${DOCKER_TAG}-${ARCHITECTURE}" NO_CACHE="${{ inputs.NO_CACHE }}"
          echo "Pushing github actions image..."
          docker push "ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:githubactions-${DOCKER_TAG}-${ARCHITECTURE}"
          echo "## PUSHED IMAGE : ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:githubactions-${DOCKER_TAG}-${ARCHITECTURE}" >> "$GITHUB_STEP_SUMMARY"
        env:
          DOCKER_TAG: ${{ inputs.docker_tag }}
          CONTAINER_NAME: '${{ inputs.container_name }}'
          ARCHITECTURE: '${{ matrix.arch }}'
      - name: Push latest image
        if: ${{ inputs.tag_latest }}
        run: |
          docker tag "ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:${DOCKER_TAG}-${ARCHITECTURE}" "ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:latest-${ARCHITECTURE}"
          echo "Pushing latest image..."
          docker push "ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:latest-${ARCHITECTURE}"
          echo "## PUSHED IMAGE : ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:latest-${ARCHITECTURE}" >> "$GITHUB_STEP_SUMMARY"

          docker tag "ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:githubactions-${DOCKER_TAG}-${ARCHITECTURE}" "ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:githubactions-latest-${ARCHITECTURE}"
          echo "Pushing github actions latest image..."
          docker push "ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:githubactions-latest-${ARCHITECTURE}"
          echo "## PUSHED IMAGE : ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:githubactions-latest-${ARCHITECTURE}" >> "$GITHUB_STEP_SUMMARY"
        env:
          DOCKER_TAG: ${{ inputs.docker_tag }}
          CONTAINER_NAME: '${{ inputs.container_name }}'
          ARCHITECTURE: '${{ matrix.arch }}'
  publish_combined_image:
    name: Publish combined image for ${{ inputs.container_name }}
    runs-on: ubuntu-22.04
    needs: build_and_push_image
    permissions:
      contents: read
      packages: write
      attestations: write
      id-token: write
    steps:
      - name: Login to github container registry
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9
        with:
              registry: ghcr.io
              username: ${{github.actor}}
              password: ${{secrets.GITHUB_TOKEN}}

      - name: Push multi-arch tagged image
        run: |
          BUILD_TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
          export BUILD_TIMESTAMP
          echo "Creating combined image for tag ${DOCKER_TAG}"
          docker buildx imagetools create \
            --annotation "index:org.opencontainers.image.source=https://github.com/NHSDigital/eps-devcontainers" \
            --annotation "index:org.opencontainers.image.description=EPS devcontainer ${CONTAINER_NAME}:${DOCKER_TAG}" \
            --annotation "index:org.opencontainers.image.licenses=MIT" \
            --annotation "index:org.opencontainers.image.version=${DOCKER_TAG}" \
            --annotation "index:org.opencontainers.image.containerName=${CONTAINER_NAME}" \
            --annotation "index:org.opencontainers.image.created=${BUILD_TIMESTAMP}" \
            --annotation "index:org.opencontainers.image.authors=NHS England EPS Team" \
            --tag "ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:${DOCKER_TAG}" \
            "ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:${DOCKER_TAG}-amd64" \
            "ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:${DOCKER_TAG}-arm64"
          echo "## PUSHED IMAGE : ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:${DOCKER_TAG}" >> "$GITHUB_STEP_SUMMARY"

          echo "Creating combined image for tag githubactions-${DOCKER_TAG}"
          docker buildx imagetools create \
            --annotation "index:org.opencontainers.image.source=https://github.com/NHSDigital/eps-devcontainers" \
            --annotation "index:org.opencontainers.image.description=EPS devcontainer ${CONTAINER_NAME}:${DOCKER_TAG}" \
            --annotation "index:org.opencontainers.image.licenses=MIT" \
            --annotation "index:org.opencontainers.image.version=${DOCKER_TAG}" \
            --annotation "index:org.opencontainers.image.containerName=${CONTAINER_NAME}" \
            --annotation "index:org.opencontainers.image.created=${BUILD_TIMESTAMP}" \
            --annotation "index:org.opencontainers.image.authors=NHS England EPS Team" \
            --tag "ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:githubactions-${DOCKER_TAG}" \
            "ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:githubactions-${DOCKER_TAG}-amd64" \
            "ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:githubactions-${DOCKER_TAG}-arm64"
          echo "## PUSHED IMAGE : ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:githubactions-${DOCKER_TAG}" >> "$GITHUB_STEP_SUMMARY"
        env:
          DOCKER_TAG: ${{ inputs.docker_tag }}
          CONTAINER_NAME: '${{ inputs.container_name }}'

      - name: Push multi-arch latest image
        if: ${{ inputs.tag_latest }}
        run: |
          echo "Creating combined image for tag latest"
          docker buildx imagetools create -t "ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:latest" \
            "ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:latest-amd64" \
            "ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:latest-arm64"
          echo "## PUSHED COMBINED IMAGE : ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:latest" >> "$GITHUB_STEP_SUMMARY"

          echo "Creating combined image for tag githubactions-latest"
          docker buildx imagetools create -t "ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:githubactions-latest" \
            "ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:githubactions-latest-amd64" \
            "ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:githubactions-latest-arm64"
          echo "## PUSHED COMBINED IMAGE : ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:githubactions-latest" >> "$GITHUB_STEP_SUMMARY"

        env:
          DOCKER_TAG: ${{ inputs.docker_tag }}
          CONTAINER_NAME: '${{ inputs.container_name }}'