build-image-reusable.yaml

name: Build unified Docker image

on:
    workflow_call:
        inputs:
            if:
                description: 'Whether to run this job'
                required: false
                default: true
                type: boolean
            name:
                required: true
                type: string
            key_for_sentry_secret:
                required: false
                type: string
            key_for_posthog_secret:
                required: false
                type: string

jobs:
    build-container:
        if: ${{ inputs.if }}

        runs-on: ubuntu-latest
        env:
            CAN_PUSH: "${{ secrets.DOCKER_PASSWORD != ' && secrets.DOCKER_USERNAME != ' }}"
            SHA: ${{ github.event.pull_request.head.sha || github.sha }}

        steps:
            - name: Check out
              uses: actions/checkout@v4

            - name: Set up QEMU
              uses: docker/setup-qemu-action@v3

            - name: Set up Docker Buildx
              uses: docker/setup-buildx-action@v3

            - name: Log in to Docker Hub
              uses: docker/login-action@v3
              if: env.CAN_PUSH == 'true'
              with:
                  username: '${{ secrets.DOCKER_USERNAME }}'
                  password: '${{ secrets.DOCKER_PASSWORD }}'

            # Needed for buildx gha cache to work
            - name: Expose GitHub Runtime
              uses: crazy-max/ghaction-github-runtime@v2

            - name: Build image (${{ inputs.name }})
              run: |
                  export SENTRY_KEY=${{ secrets[inputs.key_for_sentry_secret] }}
                  export POSTHOG_KEY=${{ secrets[inputs.key_for_posthog_secret] }}
                  ./scripts/build_docker.sh build ${{ inputs.name }} ${{ env.SHA }}

            - name: Push image
              if: env.CAN_PUSH == 'true'
              run: |
                  docker push nangohq/nango:${{ inputs.name }}-${{ env.SHA }}