frontend-image.yml

name: Publish frontend image to GHCR

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

on:
  workflow_call:
    inputs:
      tag:
        type: string
        required: true
  workflow_dispatch:
    inputs:
      tag:
        description: 'Tag to publish'
        required: true
        default: 'latest'

permissions:
  contents: read

jobs:
  build-and-push:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
        with:
          egress-policy: audit

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        name: Checkout
      - uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        name: Login to GHCR
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - run: |
          set -eux -o pipefail

          FRONTEND_REPO="$(tr '[:upper:]' '[:lower:]' <<<"${FRONTEND_REPO}")"
          docker buildx create --use
          
          set_tags=""
          IFS=, read -ra SPLIT_TAGS <<<"${FRONTEND_TAGS}"
          
          for tag in "${SPLIT_TAGS[@]}"; do
              set_tags+=" --set frontend.tags=${FRONTEND_REPO}:${tag}"
          done
          
          docker buildx bake --push \
              frontend \
                  --set frontend.platform=linux/amd64,linux/arm64 \
                  ${set_tags}
        env:
          FRONTEND_REPO: ghcr.io/${{ github.repository }}/frontend
          FRONTEND_TAGS: ${{ inputs.tag }}