name: Build Multi-Arch Image (no push) description: Set up a remote Docker Buildx builder over SSH and build a multi-arch image without pushing it (e.g. to validate a Dockerfile in PRs/CI). inputs: ssh_key: description: SSH private key for the remote Docker builder host (pass via secrets) required: true image: description: Optional full image reference (host/path/name) without tag, used only to tag the build result required: false default: "" image_tag: description: Tag(s) to apply when `image` is set. Comma-separated for multiple tags (e.g. "latest,abc1234"). required: false default: latest registry_host: description: Hostname of the container registry (only used when registry_password is set) required: false default: git.ivanch.me registry_username: description: Username for the container registry (only used when registry_password is set) required: false default: ivanch registry_password: description: Optional registry password/token. Only needed if the build pulls private base images (pass via secrets). required: false default: "" platforms: description: Comma-separated list of target platforms required: false default: linux/amd64,linux/arm64 build_context: description: Docker build context path required: false default: . build_dockerfile: description: Path to the Dockerfile (relative to context) required: false default: Dockerfile build_args: description: >- Optional build arguments, one per line in KEY=VALUE form. Each line is appended as a `--build-arg KEY=VALUE` to the build command. required: false default: "" docker_host: description: Hostname of the remote Docker Buildx builder required: false default: docker-build.haven docker_user: description: SSH user for the remote Docker builder required: false default: root runs: using: composite steps: - name: Ensure Docker CLI and Buildx are installed shell: bash run: | if ! command -v docker >/dev/null 2>&1; then echo "Docker CLI not found, attempting to install it with Buildx..." if command -v apk >/dev/null 2>&1; then apk add --no-cache docker-cli docker-cli-buildx elif command -v apt-get >/dev/null 2>&1; then export DEBIAN_FRONTEND=noninteractive apt-get update -y && apt-get install -y docker.io docker-buildx elif command -v dnf >/dev/null 2>&1; then dnf install -y docker-cli docker-buildx elif command -v yum >/dev/null 2>&1; then yum install -y docker docker-buildx else echo "::error::Docker CLI is missing and no supported package manager (apk, apt-get, dnf, yum) was found." exit 1 fi fi if ! docker buildx version >/dev/null 2>&1; then echo "::error::Docker Buildx is required but is not installed." exit 1 fi - name: Log in to Container Registry (optional) if: ${{ inputs.registry_password != '' }} shell: bash env: REGISTRY_HOST: ${{ inputs.registry_host }} REGISTRY_USERNAME: ${{ inputs.registry_username }} REGISTRY_PASSWORD: ${{ inputs.registry_password }} run: | echo "${REGISTRY_PASSWORD}" \ | docker login "${REGISTRY_HOST}" \ -u "${REGISTRY_USERNAME}" \ --password-stdin - name: Set up SSH key for remote builder shell: bash env: SSH_KEY: ${{ inputs.ssh_key }} BUILDER_HOST: ${{ inputs.docker_host }} BUILDER_USER: ${{ inputs.docker_user }} run: | # Defensive: strip any stray CR (CRLF checkout via core.autocrlf). SSH_KEY=$(printf '%s' "${SSH_KEY}" | tr -d '\r') BUILDER_HOST=$(printf '%s' "${BUILDER_HOST}" | tr -d '\r') BUILDER_USER=$(printf '%s' "${BUILDER_USER}" | tr -d '\r') mkdir -p ~/.ssh echo "${SSH_KEY}" > ~/.ssh/id_ed25519 chmod 600 ~/.ssh/id_ed25519 ssh-keyscan "${BUILDER_HOST}" >> ~/.ssh/known_hosts # Fail fast if the runner can't reach / auth to the remote daemon. echo "== probing ssh://***@${BUILDER_HOST} ==" if timeout 25 ssh \ -o BatchMode=yes \ -o ConnectTimeout=10 \ -o ServerAliveInterval=5 \ -o ServerAliveCountMax=2 \ -o StrictHostKeyChecking=accept-new \ -i ~/.ssh/id_ed25519 \ "${BUILDER_USER}@${BUILDER_HOST}" \ 'docker version --format "server={{.Server.Version}}"'; then echo "SSH probe OK" else rc=$? echo "SSH probe FAILED (exit ${rc})" if [ "${rc}" = "124" ]; then echo "-> timed out: TCP opens but SSH/daemon does not answer." echo "-> Check: dockerd running on ${BUILDER_HOST}? firewall path? MTU?" fi exit "${rc}" fi - name: Set up remote Docker context and buildx shell: bash env: BUILDER_HOST: ${{ inputs.docker_host }} BUILDER_USER: ${{ inputs.docker_user }} PLATFORMS: ${{ inputs.platforms }} run: | # Same approach as build-and-push: plain docker context over SSH driving # the remote daemon's built-in buildkit. Never set DOCKER_HOST. unset DOCKER_HOST || true BUILDER_HOST=$(printf '%s' "${BUILDER_HOST}" | tr -d '\r') BUILDER_USER=$(printf '%s' "${BUILDER_USER}" | tr -d '\r') docker context rm -f remote-builder 2>/dev/null || true docker context create remote-builder \ --docker "host=ssh://${BUILDER_USER}@${BUILDER_HOST}" # Ensure qemu/binfmt is registered on the remote for cross-arch builds. if echo "${PLATFORMS}" | grep -q 'arm'; then echo "== ensuring qemu/binfmt on remote for cross-arch ==" docker --context remote-builder run --privileged --rm \ tonistiigi/binfmt --install all >/dev/null 2>&1 || \ echo "WARN: binfmt install returned non-zero (may already be present)" fi docker --context remote-builder buildx inspect >/dev/null - name: Generate tags list id: gentags shell: bash env: IMAGE: ${{ inputs.image }} IMAGE_TAGS: ${{ inputs.image_tag }} run: | TAGS_ARGS="" if [ -n "${IMAGE}" ]; then IFS=',' read -ra ADDR <<< "${IMAGE_TAGS}" for tag in "${ADDR[@]}"; do trimmed_tag=$(echo "${tag}" | xargs) if [ -n "${trimmed_tag}" ]; then TAGS_ARGS="${TAGS_ARGS} -t ${IMAGE}:${trimmed_tag}" fi done fi echo "tag_args=${TAGS_ARGS}" >> "$GITHUB_OUTPUT" - name: Generate build args id: genbuildargs shell: bash env: BUILD_ARGS_INPUT: ${{ inputs.build_args }} run: | ARGS="" while IFS= read -r line; do trimmed=$(printf '%s' "${line}" | tr -d '\r' | xargs) if [ -n "${trimmed}" ]; then ARGS="${ARGS} --build-arg ${trimmed}" fi done <<< "${BUILD_ARGS_INPUT}" echo "build_args=${ARGS}" >> "$GITHUB_OUTPUT" - name: Build Multi-Arch Image (no push) shell: bash env: BUILD_CONTEXT: ${{ inputs.build_context }} BUILD_DOCKERFILE: ${{ inputs.build_dockerfile }} PLATFORMS: ${{ inputs.platforms }} TAG_ARGS: ${{ steps.gentags.outputs.tag_args }} BUILD_ARGS: ${{ steps.genbuildargs.outputs.build_args }} run: | unset DOCKER_HOST || true # Build only: no --push / --load. The result stays in the remote # builder's cache, so a failing Dockerfile still fails the step. docker --context remote-builder buildx build \ --platform "${PLATFORMS}" \ --file "${BUILD_CONTEXT}/${BUILD_DOCKERFILE}" \ ${BUILD_ARGS} \ ${TAG_ARGS} \ "${BUILD_CONTEXT}"