kaniko-action/action.yaml

name: 'Kaniko Build & Push'
description: 'Builds a (multi-stage) Dockerfile using Kaniko and pushes it to container registry'
author: 'tertek'

inputs:
  registry_user:
    description: 'Username for the container registry authentication'
    required: true
  registry_token:
    description: 'Password or Token for the container registry authentication'
    required: true
  dockerfile_path:
    description: 'Relative path to the Dockerfile (e.g., ./test-1/Dockerfile)'
    required: false
    default: './Dockerfile'
  target_stage:
    description: 'Target stage to build in a multi-stage Dockerfile'
    required: false
    default: ''
  destination_image:
    description: 'The full image name and tag (e.g., my-repo/php-fpm:test)'
    required: true
  image_tag:
    description: 'Name of the image tag, appended to the image name with :latest as default'
    required: false
    default: 'latest'    
  cache_repo:
    description: 'Custom path for Kaniko cache layers'
    required: false
    default: ''
  build_args:
    description: 'Optional build arguments separated by spaces or newlines (e.g., KEY=VAL)'
    required: false
    default: ''
  multi_stage_caching:
    description: 'Enforce cache elision feature flags at the binary execution layer'
    required: false
    default: 'true'

runs:
  using: 'composite'
  steps:

    - name: Cache Kaniko Layers Locally
      uses: actions/cache@v4
      with:
        path: ${{ forgejo.workspace }}/.kaniko-local-cache
        key: kaniko-cache-${{ hashFiles('**/composer.lock', '**/Dockerfile') }}
        restore-keys: |
          kaniko-cache-  

    - name: Build and Push with Kaniko
      shell: sh
      env:
        INPUT_BUILD_ARGS: ${{ inputs.build_args }}
      run: |

        # 0. Enforce cache elision feature flags at the binary execution layer
        export FF_KANIKO_SKIP_CACHED_STAGES=true
        export FF_KANIKO_INFER_CROSS_STAGE_CACHE_KEY=true
        export FF_KANIKO_CACHE_LOOKAHEAD=true
        export FF_KANIKO_ROLLING_CACHE_KEY=true

        # 1. Initialize Kaniko Docker config directory
        mkdir -p /kaniko/.docker
        
        # 2. Authenticate cleanly using the full server URL string
        echo "{\"auths\":{\"${{ forgejo.server_url }}\":{\"username\":\"${{ inputs.registry_user }}\",\"password\":\"${{ inputs.registry_token }}\"}}}" > /kaniko/.docker/config.json

        # 3. Clean up the domain name specifically for destinations and cache routing pointers
        REGISTRY_DOMAIN=$(echo "${{ forgejo.server_url }}" | sed -e 's/https:\/\///g' -e 's/http:\/\///g')
        
        # 4. Construct execution arguments dynamically based on optional inputs
        TARGET_ARG=""
        if [ -n "${{ inputs.target_stage }}" ]; then
          TARGET_ARG="--target=${{ inputs.target_stage }}"
        fi

        CACHE_REPO_ARG="$REGISTRY_DOMAIN/${{ forgejo.repository }}/cache"
        if [ -n "${{ inputs.cache_repo }}" ]; then
          CACHE_REPO_ARG="${{ inputs.cache_repo }}"
        fi

        DYNAMIC_BUILD_ARGS=""
        for arg in $INPUT_BUILD_ARGS; do
          DYNAMIC_BUILD_ARGS="$DYNAMIC_BUILD_ARGS --build-arg=$arg"
        done 

        # 5. Fire Kaniko executor
        /kaniko/executor \
          --context="dir://${{ forgejo.workspace }}" \
          --dockerfile="${{ forgejo.workspace }}/${{ inputs.dockerfile_path }}" \
          $TARGET_ARG \
          $DYNAMIC_BUILD_ARGS \
          --destination="$REGISTRY_DOMAIN/${{ inputs.destination_image }}:${{ inputs.image_tag }}" \
          --cache=true \
          --use-new-run=true \
          --snapshot-mode=redo \
          --cache-dir="${{ forgejo.workspace }}/.kaniko-local-cache"
          --cache-repo="$CACHE_REPO_ARG"