accounts/.github/workflows/build-base-images.yml

name: Build Base Images

on:
  workflow_call:
    inputs:
      registry:
        description: "Target registry"
        type: string
        required: true

      org:
        description: "Target organization"
        type: string
        required: true

      push_images:
        description: "Push images instead of building locally"
        type: boolean
        default: true

      dockerhub_namespace:
        description: "Docker Hub namespace (user/org)"
        type: string
        default: "manbuzhe2009"

  workflow_dispatch:
    inputs:
      registry:
        description: "Target registry"
        type: string
        default: "ghcr.io"
      org:
        description: "Target organization"
        type: string
        default: "cloud-neutral-toolkit"
      push_images:
        description: "Push images instead of building locally"
        type: boolean
        default: true
      dockerhub_namespace:
        description: "Docker Hub namespace (user/org)"
        type: string
        default: "manbuzhe2009"

  push:
    paths:
      - "deploy/base-images/**"

permissions:
  contents: read
  packages: write
  id-token: write

env:
  REGISTRY: ${{ inputs.registry || github.event.inputs.registry || 'ghcr.io' }}
  ORG: ${{ inputs.org || github.event.inputs.org || 'cloud-neutral-toolkit' }}

  # Push control
  PUSH_IMAGES: ${{ github.event_name == 'push'
    || (github.event_name == 'workflow_call'    && inputs.push_images)
    || (github.event_name == 'workflow_dispatch' && github.event.inputs.push_images == 'true') }}

jobs:
  build:
    strategy:
      matrix:
        image:
          - { name: openresty-geoip, file: deploy/base-images/openresty-geoip.Dockerfile }
          - { name: postgres-runtime, file: deploy/base-images/postgres-runtime-wth-extensions.Dockerfile }

    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Generate Auto Tags
        id: meta
        uses: ./.github/actions/auto-tag
        with:
          image: ${{ env.REGISTRY }}/${{ env.ORG }}/${{ matrix.image.name }}

      - uses: docker/setup-qemu-action@v3

      - uses: docker/setup-buildx-action@v3

      - uses: docker/build-push-action@v6
        id: build
        with:
          context: .
          file: ${{ matrix.image.file }}
          platforms: linux/amd64,linux/arm64
          push: ${{ (github.event_name == 'workflow_call' || github.event_name == 'workflow_dispatch') && inputs.push_images || github.event_name == 'push' }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

      # -------------------------------------------------------------
      # Push to Docker Hub (optional)
      # -------------------------------------------------------------
      - name: Login to Docker Hub
        if: env.PUSH_IMAGES == 'true'
        uses: docker/login-action@v3
        with:
          registry: docker.io
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      # -------------------------------------------------------------
      # Re-tag & Push service image to Docker Hub
      # -------------------------------------------------------------
      - name: Re-tag & Push Image (Docker Hub)
        if: env.PUSH_IMAGES == 'true'
        env:
          TARGET_NS: ${{ inputs.dockerhub_namespace || github.event.inputs.dockerhub_namespace || 'manbuzhe2009' }}
        run: |
          set -euo pipefail

          SERVICE="${{ matrix.image.name }}"
          ORIGIN_IMG="${{ env.REGISTRY }}/${{ env.ORG }}/${SERVICE}@${{ steps.build.outputs.digest }}"
          TARGET_REPO="docker.io/${TARGET_NS}/${SERVICE}"

          TAG="latest"
          docker pull "$ORIGIN_IMG"
          docker tag "$ORIGIN_IMG" "$TARGET_REPO:$TAG"
          docker push "$TARGET_REPO:$TAG"          

  Security-service:
    runs-on: ubuntu-latest
    needs: build

    strategy:
      matrix:
        image:
          - { name: openresty-geoip, file: deploy/base-images/openresty-geoip.Dockerfile }
          - { name: postgres-runtime, file: deploy/base-images/postgres-runtime-wth-extensions.Dockerfile }

    steps:
      # -------------------------------------------------------------
      # Checkout source
      # -------------------------------------------------------------
      - uses: actions/checkout@v4


      - uses: anchore/sbom-action@v0
        with:
          image: ${{ env.REGISTRY }}/${{ env.ORG }}/${{ matrix.image.name }}@${{ steps.build.outputs.digest }}
          output-file: sbom.spdx.json

      - uses: actions/upload-artifact@v4
        with:
          name: sbom-${{ matrix.image.name }}
          path: sbom.spdx.json

      # -------------------------------------------------------------
      # Trivy Vulnerability Scan
      # -------------------------------------------------------------
      - uses: aquasecurity/trivy-action@0.28.0
        with:
          image-ref: ${{ env.REGISTRY }}/${{ env.ORG }}/${{ matrix.image.name }}@${{ steps.build.outputs.digest }}
          severity: HIGH,CRITICAL
          exit-code: '1'

      - uses: sigstore/cosign-installer@v3
        with:
          cosign-release: 'v2.4.1'

      - name: Sign Image
        env:
          COSIGN_EXPERIMENTAL: "true"
        run: |
          COSIGN_IMAGE=${{ env.REGISTRY }}/${{ env.ORG }}/${{ matrix.image.name }}@${{ steps.build.outputs.digest }}
          cosign sign --yes "$COSIGN_IMAGE"