name: Reusable build app container image workflow

on:
  workflow_call:
    inputs:
      image-name:
        type: string
        default: weseek/growi
      tag-temporary:
        type: string
        default: latest
    secrets:
      AWS_ROLE_TO_ASSUME_FOR_OIDC:
        required: true



jobs:

  build-image:
    runs-on: ubuntu-latest

    # These permissions are needed to interact with GitHub's OIDC Token endpoint.
    permissions:
      id-token: write
      contents: write

    strategy:
      matrix:
        platform: [amd64, arm64]

    steps:
    - uses: actions/checkout@v3

    - name: Configure AWS Credentials
      uses: aws-actions/configure-aws-credentials@v1
      with:
        aws-region: ap-northeast-1
        role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME_FOR_OIDC }}
        role-session-name: SessionForReleaseGROWI-RC

    - name: Run CodeBuild
      uses: aws-actions/aws-codebuild-run-build@v1
      with:
        project-name: growi-official-image-builder
        image-override: ${{ (matrix.platform == 'amd64' && 'aws/codebuild/standard:6.0') || 'aws/codebuild/amazonlinux2-aarch64-standard:2.0' }}
        environment-type-override: ${{ (matrix.platform == 'amd64' && 'LINUX_CONTAINER') || 'ARM_CONTAINER' }}
        env-vars-for-codebuild: |
          IMAGE_TAG,
          IMAGE_TAG_GHCR
      env:
        IMAGE_TAG: docker.io/${{ inputs.image-name }}:${{ inputs.tag-temporary }}-${{ matrix.platform }}
        IMAGE_TAG_GHCR: ghcr.io/${{ inputs.image-name }}:${{ inputs.tag-temporary }}-${{ matrix.platform }}