docker-build-push.yml

---
name: 🐳 docker-build-push

on:
  workflow_call:
    inputs:
      provider:
        required: false
        type: string
      images:
        required: false
        type: string
      aws_region:
        required: false
        type: string
      ECR_REPOSITORY:
        required: false
        type: string
      IMAGE_TAG:
        required: true
        type: string
      BUILD_PATH:
        required: false
        type: string
        default: '.'
      WORKING_DIRECTORY:
        required: false
        type: string
      assume_role_arn:
        required: false
        type: string
      role_duration_seconds:
        description: 'Lifetime of the assumed role session, in seconds. Empty uses the action default.'
        required: false
        default: ''
        type: string
      role_skip_session_tagging:
        description: "Whether to skip adding session tags when assuming the AWS IAM role."
        required: false
        type: boolean
        default: true
    secrets:
      AWS_ACCESS_KEY_ID:
        required: false
        description: 'AWS Access Key ID to install AWS CLI.'
      BUILD_ROLE:
        required: false
        description: 'AWS OIDC role for aws authentication.'
      AWS_SECRET_ACCESS_KEY:
        required: false
        description: 'AWS Secret access key to install AWS CLI'
      AWS_SESSION_TOKEN:
        required: false
        description: 'AWS Session Token to install AWS CLI'
      DOCKERHUB_USERNAME:
        description: 'dockerhub username'
        required: false
      DOCKERHUB_PASSWORD:
        description: 'dockerhub password'
        required: false
      NAORU_API_KEY:
        required: false
        description: 'API key for naoru AI failure diagnosis (OpenRouter provider by default).'

jobs:
  build-image:
    name: 🏗️ Build Images
    runs-on: ubuntu-latest

    steps:

      - name: 📦 Checkout Repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: 🔑 Login to Docker Hub
        if: ${{ inputs.provider == 'DOCKERHUB' }}
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_PASSWORD }}

      - name: 🚀 Push docker image to DOCKERHUB
        if: ${{ inputs.provider == 'DOCKERHUB' }}
        env:
          IMAGE_TAG: ${{ inputs.IMAGE_TAG }}
          images: ${{ inputs.images }}
          BUILD_PATH: ${{ inputs.BUILD_PATH }}
        run: |
          docker build -t $images:$IMAGE_TAG $BUILD_PATH
          docker push $images:$IMAGE_TAG

      - name: 🔧 Configure AWS credentials
        if: ${{ inputs.provider == 'aws' }}
        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }}
          role-to-assume: ${{ inputs.assume_role_arn || secrets.BUILD_ROLE }}
          aws-region: ${{ inputs.aws_region }}
          role-duration-seconds: ${{ inputs.role_duration_seconds }}
          role-skip-session-tagging: ${{ inputs.role_skip_session_tagging }}

      - name: 🕵️ Verify awscli
        if: ${{ inputs.provider == 'aws' }}
        run: |
          aws sts get-caller-identity


      - name: 🔑 Login to Amazon ECR
        if: ${{ inputs.provider == 'aws' }}
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@03f1aad4c6c7ffd436567f42f9384779290529bd # v2.1.7

      - name: 🚢 Push docker image to Amazon ECR
        if: ${{ inputs.provider == 'aws' }}
        id: docker-build
        env:
          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
          ECR_REPOSITORY: ${{ inputs.ECR_REPOSITORY }}
          IMAGE_TAG: ${{ inputs.IMAGE_TAG }}
          BUILD_PATH: ${{ inputs.BUILD_PATH }}
        working-directory: ${{ inputs.WORKING_DIRECTORY }}
        run: |
          docker build -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG $BUILD_PATH
          docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG

      - name: 🚀🚢 Push docker image to Amazon ECR and DOCKERHUB
        if: ${{ inputs.provider == 'DOCKERHUB,aws' }}
        env:
          ## For ECR env variable
          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
          ECR_REPOSITORY: ${{ inputs.ECR_REPOSITORY }}
          IMAGE_TAG: ${{ inputs.IMAGE_TAG }}
          BUILD_PATH: ${{ inputs.BUILD_PATH }}
          ## For DOCKERHUB env variable
          images: ${{ inputs.images }}
        run: |
          docker build -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG $BUILD_PATH
          docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
          docker build -t $images:$IMAGE_TAG $BUILD_PATH
          docker push $images:$IMAGE_TAG

  naoru:
    name: 🩺 Diagnose failure (naoru)
    needs: [build-image]
    if: ${{ failure() }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
      actions: read
      pull-requests: write
    steps:
      - name: 🩺 Diagnose with naoru
        env:
          NAORU_KEY: ${{ secrets.NAORU_API_KEY }}
        if: ${{ env.NAORU_KEY != '' }}
        uses: clouddrove/naoru@1fbf9f8977d855a35865c771679bb51f7474e397 # v0.2.3
        with:
          api-key: ${{ secrets.NAORU_API_KEY }}
          provider: openrouter
          model: openai/gpt-4o
...