docker_build_or_deploy.yml

name: Docker Build (Reusable)

on:
  workflow_call:
    inputs:
      push:
        description: 'Push image to Docker Hub and attest it'
        type: boolean
        default: false
      version:
        description: 'Version tag for the image'
        type: string
        default: ''
    secrets:
      DOCKERHUB_TOKEN:
        required: false

permissions:
  id-token: write
  attestations: write

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
      attestations: write
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      # Only log in when we intend to push (keeps secrets out of PR builds)
      - name: Log in to Docker Hub
        if: inputs.push
        uses: docker/login-action@v4.6.0
        with:
          username: tragiccode
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: tragiccode/busly-cli
          tags: |
            ${{ inputs.version }}
            latest

      - name: Build (and maybe push) Docker image
        id: push
        uses: docker/build-push-action@v7
        with:
          context: .
          file: ./src/BuslyCLI.Console/Dockerfile
          build-args: |
            APP_VERSION=${{ inputs.version }}
          push: ${{ inputs.push }}
          tags: ${{ inputs.push && steps.meta.outputs.tags || '' }}
          labels: ${{ steps.meta.outputs.labels }}

      - name: Generate artifact attestation
        if: inputs.push
        uses: actions/attest-build-provenance@v4
        with:
          subject-name: index.docker.io/tragiccode/busly-cli
          subject-digest: ${{ steps.push.outputs.digest }}
          push-to-registry: true