docker-build-push.yml

---
# This workflow builds and pushes Docker images to GHCR
name: Build Docker Images
permissions: {}
"on":
  workflow_call:
    inputs:
      image-tag:
        required: true
        type: string
        description: 'Docker image tag (e.g., v1.2.3, pr-123, sha-abc123)'
      apps:
        required: true
        type: string
        description: 'JSON array of apps to build (e.g., [{"name": "testapp", "dockerfile": "apps/testapp/Dockerfile"}])'

jobs:
  build-images:
    name: Build ${{ matrix.app.name }}
    # skip building images for merge groups as they are already built on PRs and main
    if: github.event_name != 'merge_group'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    strategy:
      matrix:
        app: ${{ fromJson(inputs.apps) }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v6.0.2

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push ${{ matrix.app.name }} Docker image
        uses: docker/build-push-action@v7
        with:
          context: .
          file: ${{ matrix.app.dockerfile }}
          push: true
          platforms: linux/amd64,linux/arm64
          tags: ghcr.io/${{ github.repository_owner }}/${{ matrix.app.name }}:${{ inputs.image-tag }}