pipeline-actions/build-and-push/action.yaml

name: Build and Push Multi-Arch Image
description: Log in to a container registry, set up a remote Docker Buildx builder over SSH, and build + push a multi-arch image.

inputs:
  registry_host:
    description: Hostname of the container registry
    required: true
    default: git.ivanch.me
  registry_username:
    description: Username for the container registry
    required: true
    default: ivanch
  registry_password:
    description: Password / token for the container registry (pass via secrets)
    required: true
  image:
    description: Full image reference (host/path/name) without tag
    required: true
  image_tag:
    description: Tag(s) to apply to the built image. Comma-separated for multiple tags (e.g. "latest,abc1234").
    required: false
    default: latest
  platforms:
    description: Comma-separated list of target platforms
    required: false
    default: linux/amd64,linux/arm64
  build_context:
    description: Docker build context path
    required: false
    default: .
  build_dockerfile:
    description: Path to the Dockerfile (relative to context)
    required: false
    default: Dockerfile
  ssh_key:
    description: SSH private key for the remote Docker builder host (pass via secrets)
    required: true
  docker_host:
    description: Hostname of the remote Docker Buildx builder
    required: false
    default: docker-build.haven
  docker_user:
    description: SSH user for the remote Docker builder
    required: false
    default: root

runs:
  using: composite
  steps:
    - name: Log in to Container Registry
      shell: bash
      env:
        REGISTRY_HOST: ${{ inputs.registry_host }}
        REGISTRY_USERNAME: ${{ inputs.registry_username }}
        REGISTRY_PASSWORD: ${{ inputs.registry_password }}
      run: |
        echo "${REGISTRY_PASSWORD}" \
          | docker login "${REGISTRY_HOST}" \
              -u "${REGISTRY_USERNAME}" \
              --password-stdin

    - name: Set up SSH key for remote builder
      shell: bash
      env:
        SSH_KEY: ${{ inputs.ssh_key }}
        BUILDER_HOST: ${{ inputs.docker_host }}
      run: |
        mkdir -p ~/.ssh
        echo "${SSH_KEY}" > ~/.ssh/id_ed25519
        chmod 600 ~/.ssh/id_ed25519
        ssh-keyscan "${BUILDER_HOST}" >> ~/.ssh/known_hosts

    - name: Set up remote Docker Buildx builder
      shell: bash
      env:
        BUILDER_HOST: ${{ inputs.docker_host }}
        BUILDER_USER: ${{ inputs.docker_user }}
      run: |
        # Never set the DOCKER_HOST env var to the builder hostname: a bare
        # value is treated as tcp://host:2375 and, more importantly, DOCKER_HOST
        # *overrides* the active docker context — which is exactly what broke
        # the previous version (it tried tcp://docker-build.haven:2375 instead
        # of the SSH context). We drive everything through a context instead.
        unset DOCKER_HOST || true

        docker context rm -f remote-builder 2>/dev/null || true
        docker context create remote-builder \
          --docker "host=ssh://${BUILDER_USER}@${BUILDER_HOST}"

        # build-push-action's `builder: remote-builder` needs a *buildx builder
        # instance* named remote-builder, not just a context. Create it from the
        # SSH context so it resolves to the remote engine over SSH.
        docker buildx rm -f remote-builder 2>/dev/null || true
        docker buildx create --name remote-builder --context remote-builder --use
        docker buildx inspect --bootstrap

    - name: Generate tags list
      id: gentags
      shell: bash
      env:
        IMAGE: ${{ inputs.image }}
        IMAGE_TAGS: ${{ inputs.image_tag }}
      run: |
        TAGS_LIST=""
        IFS=',' read -ra ADDR <<< "${IMAGE_TAGS}"
        for tag in "${ADDR[@]}"; do
          trimmed_tag=$(echo "${tag}" | xargs)
          if [ -n "${trimmed_tag}" ]; then
            TAGS_LIST="${TAGS_LIST}${IMAGE}:${trimmed_tag}"$'\n'
          fi
        done
        
        echo "tags<<EOF" >> "$GITHUB_OUTPUT"
        echo -n "${TAGS_LIST}" >> "$GITHUB_OUTPUT"
        echo "EOF" >> "$GITHUB_OUTPUT"

    - name: Build and Push Multi-Arch Image
      uses: docker/build-push-action@v6
      with:
        push: true
        context: ${{ inputs.build_context }}
        file: ${{ inputs.build_dockerfile }}
        builder: remote-builder
        platforms: ${{ inputs.platforms }}
        tags: ${{ steps.gentags.outputs.tags }}