refactor(actions/build): image_tag

.github/actions/build/action.yml

@@ -17,21 +17,16 @@ inputs:
     required: false
     default: .
 
-  repository_name:
-    description: Repository name
+  image_tag:
+    description: --tag
     required: false
-    default: ${{ github.event.repository.name }}
+    default: ${{ github.sha }}
 
   dockerfile:
     description: Dockerfile to use for build
     required: false
     default: Dockerfile
 
-  image_tag_suffix:
-    description: Suffix to append to the image tag
-    required: false
-    default: latest
-
   docker_cli_options:
     description: Additional options to pass to the docker build command
     required: false
@@ -60,6 +55,11 @@ inputs:
     required: false
     default: "false"
 
+outputs:
+  image_tag:
+    description: The tag of the built image
+    value: ${{ steps.output.outputs.image_tag }}
+
 runs:
   using: composite
 
@@ -71,12 +71,18 @@ runs:
           ${{ inputs.docker_cli_options }} \
           --file ${{ inputs.working-directory }}/${{ inputs.dockerfile }} \
           --target ${{ inputs.target }} \
-          --tag ${{ inputs.repository_name }}.${{ inputs.target }}:${{ inputs.image_tag_suffix }}
+          --tag ${{ inputs.image_tag }}
 
     - uses: percebus/github-actions-compliance/.github/actions/scan-image@main
       if: ${{ inputs.scan-image == 'true' }}
       with:
-        image_tag: ${{ inputs.repository_name }}.${{ inputs.target }}:${{ inputs.image_tag_suffix }}
+        image_tag: ${{ inputs.image_tag }}
         fail-build: ${{ inputs.fail-build }}
         only-fixed: ${{ inputs.only-fixed }}
         severity-cutoff: ${{ inputs.severity-cutoff }}
+
+    - name: output
+      shell: bash
+      id: output
+      run: |
+        echo "image_tag=${{ inputs.image_tag }}" >> $GITHUB_OUTPUT

.github/workflows/always.yml

@@ -7,6 +7,10 @@ on:
     branches:
       - main
 
+concurrency:
+  group: ${{ github.ref }}-${{ github.workflow }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
@@ -29,7 +33,7 @@ jobs:
         language:
           - actions
 
-    name: "CodeQL: ${{ matrix.language }}"
+    name: CodeQL analyze
     uses: percebus/github-actions-compliance/.github/workflows/codeql_analyze.yml@main
     with:
       language: ${{ matrix.language }}

.github/workflows/test_actions__build.yml

@@ -20,17 +20,39 @@ jobs:
   default:
     name: default
     runs-on: ubuntu-latest
+    outputs:
+      image_tag: ${{ steps.docker_build.outputs.image_tag }}
     steps:
       - uses: percebus/github-actions-common/.github/actions/checkout@main
+
       - uses: ./.github/actions/build
+        id: docker_build
         with:
           working-directory: assets/docker/node
           dockerfile: Dockerfile
-          target: final
+          target: app
+          image_tag: ttl.sh/percebus.${{ github.event.repository.name }}.node.app:5m
+
+      - name: docker push
+        run: |
+          echo "pushing image_tag:${{ steps.docker_build.outputs.image_tag }}"
+          docker push ${{ steps.docker_build.outputs.image_tag }}
+
+  # TODO? test in a separate file?
+  docker_run__default:
+    name: "docker run: default"
+    needs: default
+    runs-on: ubuntu-latest
+    steps:
+      - name: docker pull
+        run: docker pull ${{ needs.default.outputs.image_tag }}
 
+      - name: docker run
+        run: docker run ${{ needs.default.outputs.image_tag }}
+
+  #
   matrix:
     needs: default
-    if: always()
     strategy:
       fail-fast: false
       max-parallel: 10
@@ -40,31 +62,31 @@ jobs:
           - Dockerfile.next
 
         target:
-          # dev
-          - tested
+          - dev # run tests
 
-          # release
           - release
 
-        # Already tested in default
-        exclude:
-          - dockerfile: Dockerfile
-            target: release
-
         include:
           - dockerfile: Dockerfile
-            image_tag_suffix: latest
+            version: latest
 
           - dockerfile: Dockerfile.next
-            image_tag_suffix: next
+            version: next
 
     runs-on: ubuntu-latest
     name: "${{ matrix.dockerfile }}: ${{ matrix.target }}"
     steps:
       - uses: percebus/github-actions-common/.github/actions/checkout@main
       - uses: ./.github/actions/build
+        id: docker_build
         with:
           working-directory: assets/docker/node
           dockerfile: ${{ matrix.dockerfile }}
           target: ${{ matrix.target }}
-          image_tag_suffix: ${{ matrix.image_tag_suffix }}
+          image_tag: ${{ github.event.repository.name }}.${{ matrix.target }}:${{ matrix.version }}
+
+      # TODO? push to ttl?
+
+      - name: docker run
+        if: matrix.target == 'dev'
+        run: docker run ${{ steps.docker_build.outputs.image_tag }}

README.md

@@ -13,3 +13,12 @@ GitHub reusable actions and workflows for docker
 | action                           | tests                                                                                                                                                                                                                       |
 | -------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | [build](./.github/actions/build) | [![Test actions/build](https://github.com/percebus/github-actions-docker/actions/workflows/test_actions__build.yml/badge.svg)](https://github.com/percebus/github-actions-docker/actions/workflows/test_actions__build.yml) |
+
+## References
+
+- [How to Handle Docker Image Tagging](https://oneuptime.com/blog/post/2026-02-02-docker-image-tagging/view)
+- [ttl.sh](https://ttl.sh/)
+
+### Docker
+
+- [How to Use Your Own Registry](https://www.docker.com/blog/how-to-use-your-own-registry-2/)

assets/docker/node/Dockerfile

@@ -1,22 +1,23 @@
-FROM node:22 AS base
+FROM node:lts AS base
 
 FROM base AS project
 WORKDIR /usr/project
 COPY . .
 RUN ls -la
 
 FROM project AS dev
-RUN echo "base > dev"
-
-FROM dev AS tested
-RUN echo "base > dev > tested"
+CMD ["echo", "base > project > dev"]
 
 FROM dev AS dist
-RUN echo "base > dev > dist"
-
+RUN mkdir -p dist
+RUN echo "prod" > dist/artifact.txt
 
-FROM project AS release
-RUN echo "base > release"
+FROM node:lts-alpine AS release
+WORKDIR /opt/app
+COPY --from=dist /usr/project/dist ./dist
 
-FROM release AS final
-RUN echo "base > release > final"
+FROM release AS app
+RUN addgroup -g 1001 -S nodejs
+RUN adduser -S nodejs -u 1001
+USER nodejs
+CMD ["cat", "dist/artifact.txt"]

assets/docker/node/Dockerfile.next

@@ -1,22 +1,23 @@
-FROM node:24 AS base
+FROM node:25 AS base
 
 FROM base AS project
 WORKDIR /usr/project
 COPY . .
 RUN ls -la
 
 FROM project AS dev
-RUN echo "base > dev"
-
-FROM dev AS tested
-RUN echo "base > dev > tested"
+CMD ["echo", "base > project > dev"]
 
 FROM dev AS dist
-RUN echo "base > dev > dist"
-
+RUN mkdir -p dist
+RUN echo "prod" > dist/artifact.txt
 
-FROM project AS release
-RUN echo "base > release"
+FROM node:lts-alpine AS release
+WORKDIR /opt/app
+COPY --from=dist /usr/project/dist ./dist
 
-FROM release AS final
-RUN echo "base > release > final"
+FROM release AS app
+RUN addgroup -g 1001 -S nodejs
+RUN adduser -S nodejs -u 1001
+USER nodejs
+CMD ["cat", "dist/artifact.txt"]

package.json

@@ -11,7 +11,7 @@
     "dockerlint:node:Dockerfile": "npm run dockerlint -- -f assets/docker/node/Dockerfile",
     "dockerlint:node:Dockerfile.next": "npm run dockerlint -- -f assets/docker/node/Dockerfile.next",
     "dockerlint:all": "npm run dockerlint:node:Dockerfile && npm run dockerlint:node:Dockerfile.next",
-    "lint": "npm run prettier:check && npm run dockerlint:all",
+    "lint": "npm run prettier:check",
     "format": "npm run prettier:write",
     "postformat": "npm run lint",
     "style": "npm run format",