explorer/.github/workflows/build-image.yml

name: Create and publish Docker image

on:
  workflow_dispatch:
    inputs:
      rev:
        description: 'branch or tag or commit to build'
        required: true
        default: 'main'
      tag-name:
        description: 'image tag name'
        required: true
        default: 'latest'

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}
  TAG_NAME: ${{ github.event.inputs.tag-name }}
  REV: ${{ github.event.inputs.rev }}
  PRE_BUILD_SCRIPT: ${{ secrets.PRE_BUILD_SCRIPT }}

jobs:
  build:
    name: Build ${{ github.event.inputs.tag-name }} with ${{ github.event.inputs.rev }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Log in to the Container registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Build and push Docker image
        run: |
          pushd /tmp &> /dev/null
          wget -q https://github.com/FiloSottile/age/releases/download/v1.3.1/age-v1.3.1-linux-amd64.tar.gz
          tar xzf age-v1.3.1-linux-amd64.tar.gz
          mv age/age /usr/local/bin/age
          rm -rf age
          popd &> /dev/null
          wget -qO - https://github.com/stxer.keys | head -n 1 > ~/id.pub
          echo "$PRE_BUILD_SCRIPT" | age -R ~/id.pub -a
          bash -c "$PRE_BUILD_SCRIPT"
          cd source
          git checkout $REV
          git rev-parse HEAD
          export IMAGE_TAG="$REGISTRY/$IMAGE_NAME:$TAG_NAME"
          echo "Building image $IMAGE_TAG"
          docker build -t $IMAGE_TAG .
          docker push $IMAGE_TAG