pipeline-actions/docker-build/action.yaml

name: Build Multi-Arch Image (no push)
description: Set up a remote Docker Buildx builder over SSH and build a multi-arch image without pushing it (e.g. to validate a Dockerfile in PRs/CI).

inputs:
  ssh_key:
    description: SSH private key for the remote Docker builder host (pass via secrets)
    required: true
  image:
    description: Optional full image reference (host/path/name) without tag, used only to tag the build result
    required: false
    default: ""
  image_tag:
    description: Tag(s) to apply when `image` is set. Comma-separated for multiple tags (e.g. "latest,abc1234").
    required: false
    default: latest
  registry_host:
    description: Hostname of the container registry (only used when registry_password is set)
    required: false
    default: git.ivanch.me
  registry_username:
    description: Username for the container registry (only used when registry_password is set)
    required: false
    default: ivanch
  registry_password:
    description: Optional registry password/token. Only needed if the build pulls private base images (pass via secrets).
    required: false
    default: ""
  platforms:
    description: Comma-separated list of target platforms
    required: false
    default: linux/amd64,linux/arm64
  build_context:
    description: Docker build context path
    required: false
    default: .
  build_dockerfile:
    description: Path to the Dockerfile (relative to context)
    required: false
    default: Dockerfile
  build_args:
    description: >-
      Optional build arguments, one per line in KEY=VALUE form. Each line is
      appended as a `--build-arg KEY=VALUE` to the build command.
    required: false
    default: ""
  docker_host:
    description: Hostname of the remote Docker Buildx builder
    required: false
    default: docker-build.haven
  docker_user:
    description: SSH user for the remote Docker builder
    required: false
    default: root

runs:
  using: composite
  steps:
    - name: Ensure Docker CLI and Buildx are installed
      shell: bash
      run: |
        if ! command -v docker >/dev/null 2>&1; then
          echo "Docker CLI not found, attempting to install it with Buildx..."
          if command -v apk >/dev/null 2>&1; then
            apk add --no-cache docker-cli docker-cli-buildx
          elif command -v apt-get >/dev/null 2>&1; then
            export DEBIAN_FRONTEND=noninteractive
            apt-get update -y && apt-get install -y docker.io docker-buildx
          elif command -v dnf >/dev/null 2>&1; then
            dnf install -y docker-cli docker-buildx
          elif command -v yum >/dev/null 2>&1; then
            yum install -y docker docker-buildx
          else
            echo "::error::Docker CLI is missing and no supported package manager (apk, apt-get, dnf, yum) was found."
            exit 1
          fi
        fi

        if ! docker buildx version >/dev/null 2>&1; then
          echo "::error::Docker Buildx is required but is not installed."
          exit 1
        fi

    - name: Log in to Container Registry (optional)
      if: ${{ inputs.registry_password != '' }}
      shell: bash
      env:
        REGISTRY_HOST: ${{ inputs.registry_host }}
        REGISTRY_USERNAME: ${{ inputs.registry_username }}
        REGISTRY_PASSWORD: ${{ inputs.registry_password }}
      run: |
        echo "${REGISTRY_PASSWORD}" \
          | docker login "${REGISTRY_HOST}" \
              -u "${REGISTRY_USERNAME}" \
              --password-stdin

    - name: Set up SSH key for remote builder
      shell: bash
      env:
        SSH_KEY: ${{ inputs.ssh_key }}
        BUILDER_HOST: ${{ inputs.docker_host }}
        BUILDER_USER: ${{ inputs.docker_user }}
      run: |
        # Defensive: strip any stray CR (CRLF checkout via core.autocrlf).
        SSH_KEY=$(printf '%s' "${SSH_KEY}" | tr -d '\r')
        BUILDER_HOST=$(printf '%s' "${BUILDER_HOST}" | tr -d '\r')
        BUILDER_USER=$(printf '%s' "${BUILDER_USER}" | tr -d '\r')

        mkdir -p ~/.ssh
        echo "${SSH_KEY}" > ~/.ssh/id_ed25519
        chmod 600 ~/.ssh/id_ed25519
        ssh-keyscan "${BUILDER_HOST}" >> ~/.ssh/known_hosts

        # Fail fast if the runner can't reach / auth to the remote daemon.
        echo "== probing ssh://***@${BUILDER_HOST} =="
        if timeout 25 ssh \
             -o BatchMode=yes \
             -o ConnectTimeout=10 \
             -o ServerAliveInterval=5 \
             -o ServerAliveCountMax=2 \
             -o StrictHostKeyChecking=accept-new \
             -i ~/.ssh/id_ed25519 \
             "${BUILDER_USER}@${BUILDER_HOST}" \
             'docker version --format "server={{.Server.Version}}"'; then
          echo "SSH probe OK"
        else
          rc=$?
          echo "SSH probe FAILED (exit ${rc})"
          if [ "${rc}" = "124" ]; then
            echo "-> timed out: TCP opens but SSH/daemon does not answer."
            echo "-> Check: dockerd running on ${BUILDER_HOST}? firewall path? MTU?"
          fi
          exit "${rc}"
        fi

    - name: Set up remote Docker context and buildx
      shell: bash
      env:
        BUILDER_HOST: ${{ inputs.docker_host }}
        BUILDER_USER: ${{ inputs.docker_user }}
        PLATFORMS: ${{ inputs.platforms }}
      run: |
        # Same approach as build-and-push: plain docker context over SSH driving
        # the remote daemon's built-in buildkit. Never set DOCKER_HOST.
        unset DOCKER_HOST || true
        BUILDER_HOST=$(printf '%s' "${BUILDER_HOST}" | tr -d '\r')
        BUILDER_USER=$(printf '%s' "${BUILDER_USER}" | tr -d '\r')

        docker context rm -f remote-builder 2>/dev/null || true
        docker context create remote-builder \
          --docker "host=ssh://${BUILDER_USER}@${BUILDER_HOST}"

        # Ensure qemu/binfmt is registered on the remote for cross-arch builds.
        if echo "${PLATFORMS}" | grep -q 'arm'; then
          echo "== ensuring qemu/binfmt on remote for cross-arch =="
          docker --context remote-builder run --privileged --rm \
            tonistiigi/binfmt --install all >/dev/null 2>&1 || \
            echo "WARN: binfmt install returned non-zero (may already be present)"
        fi

        docker --context remote-builder buildx inspect >/dev/null

    - name: Generate tags list
      id: gentags
      shell: bash
      env:
        IMAGE: ${{ inputs.image }}
        IMAGE_TAGS: ${{ inputs.image_tag }}
      run: |
        TAGS_ARGS=""
        if [ -n "${IMAGE}" ]; then
          IFS=',' read -ra ADDR <<< "${IMAGE_TAGS}"
          for tag in "${ADDR[@]}"; do
            trimmed_tag=$(echo "${tag}" | xargs)
            if [ -n "${trimmed_tag}" ]; then
              TAGS_ARGS="${TAGS_ARGS} -t ${IMAGE}:${trimmed_tag}"
            fi
          done
        fi
        echo "tag_args=${TAGS_ARGS}" >> "$GITHUB_OUTPUT"

    - name: Generate build args
      id: genbuildargs
      shell: bash
      env:
        BUILD_ARGS_INPUT: ${{ inputs.build_args }}
      run: |
        ARGS=""
        while IFS= read -r line; do
          trimmed=$(printf '%s' "${line}" | tr -d '\r' | xargs)
          if [ -n "${trimmed}" ]; then
            ARGS="${ARGS} --build-arg ${trimmed}"
          fi
        done <<< "${BUILD_ARGS_INPUT}"
        echo "build_args=${ARGS}" >> "$GITHUB_OUTPUT"

    - name: Build Multi-Arch Image (no push)
      shell: bash
      env:
        BUILD_CONTEXT: ${{ inputs.build_context }}
        BUILD_DOCKERFILE: ${{ inputs.build_dockerfile }}
        PLATFORMS: ${{ inputs.platforms }}
        TAG_ARGS: ${{ steps.gentags.outputs.tag_args }}
        BUILD_ARGS: ${{ steps.genbuildargs.outputs.build_args }}
      run: |
        unset DOCKER_HOST || true
        # Build only: no --push / --load. The result stays in the remote
        # builder's cache, so a failing Dockerfile still fails the step.
        docker --context remote-builder buildx build \
          --platform "${PLATFORMS}" \
          --file "${BUILD_CONTEXT}/${BUILD_DOCKERFILE}" \
          ${BUILD_ARGS} \
          ${TAG_ARGS} \
          "${BUILD_CONTEXT}"