docker-images.yaml

name: Build docker images
on:
  workflow_call:
    inputs:
      lang:
        description: SDK language to build the container for
        required: true
        type: string
      sdk-repo-ref:
        description: Git ref of SDK repo to use to build (overrides "sdk-version")
        required: false
        type: string
      sdk-repo-url:
        description: URL of SDK repo to use to build (only used if "sdk-repo-ref" is provided)
        required: false
        type: string
      sdk-version:
        description: Version of SDK to use (ignored if "sdk-repo-ref" is provided)
        required: false
        type: string
      semver-latest:
        description: Tag images with major / minor versions (only used if "sdk-version" is provided - 'minor' or 'major')
        type: string
        default: 'none'
      do-push:
        description: If set, push the built image to Docker Hub.
        type: boolean
        default: false
      skip-cloud:
        description: If set, skip running cloud tests.
        type: boolean
        default: false

jobs:
  build-image:
    name: Build ${{ inputs.lang }} docker image
    runs-on: ubuntu-latest
    env:
      TEMPORAL_CLOUD_ADDRESS: sdk-ci.a2dd6.tmprl.cloud:7233
      TEMPORAL_CLOUD_NAMESPACE: sdk-ci.a2dd6
      REPO_URL: ${{ github.event.pull_request.head.repo.html_url }}
    steps:
      - name: Fail if both sdk-version and sdk-repo-ref are present
        if: inputs.sdk-version && inputs.sdk-repo-ref
        run: exit 1
      - name: Print build information
        run: 'echo head_ref: "$GITHUB_HEAD_REF", ref: "$GITHUB_REF"'
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: '^1.21'
      - name: Lint dockerfile
        run: docker run --rm -i hadolint/hadolint < dockerfiles/${{inputs.lang}}.Dockerfile

      # Download the certs to be mounted as a volume in the running container
      - name: Download certs to temporary directory
        run: |
          mkdir /tmp/temporal-certs &&
          echo "$TEMPORAL_CLIENT_CERT" > /tmp/temporal-certs/client.pem &&
          echo "$TEMPORAL_CLIENT_KEY" > /tmp/temporal-certs/client.key &&
          wc /tmp/temporal-certs/client.pem /tmp/temporal-certs/client.key
        env:
          TEMPORAL_CLIENT_CERT: ${{ secrets.TEMPORAL_CLIENT_CERT }}
          TEMPORAL_CLIENT_KEY: ${{ secrets.TEMPORAL_CLIENT_KEY }}

      # This step will set the FEATURES_BUILT_IMAGE_TAG env key
      - name: Build docker image
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          go run . build-image --lang ${{ inputs.lang }} \
          ${{ inputs.sdk-repo-ref && format('--repo-ref {0}', inputs.sdk-repo-ref) || '' }} \
          ${{ inputs.sdk-repo-ref && inputs.sdk-repo-url && format('--repo-url {0}', inputs.sdk-repo-url) || '' }} \
          ${{ !inputs.sdk-repo-ref && format('--version {0}', inputs.sdk-version) || '' }} \
          ${{ inputs.semver-latest != 'none' && format('--semver-latest {0}', inputs.semver-latest) || '' }}

      - name: Test with Dev Server
        run: docker run --rm -i -v /tmp/temporal-certs:/certs ${{ env.FEATURES_BUILT_IMAGE_TAG }}

      - name: Test with Cloud
        # Only supported in non-fork runs
        if: ${{ (github.event.pull_request.head.repo.full_name == '' || github.event.pull_request.head.repo.full_name == 'temporalio/features') && !inputs.skip-cloud }}
        run: |
          docker run --rm -i \
          -v /tmp/temporal-certs:/certs \
          --env TEMPORAL_FEATURES_DISABLE_WORKFLOW_COMPLETION_CHECK=true \
          ${{ env.FEATURES_BUILT_IMAGE_TAG }} \
          --server $TEMPORAL_CLOUD_ADDRESS \
          --namespace $TEMPORAL_CLOUD_NAMESPACE \
          --client-cert-path /certs/client.pem \
          --client-key-path /certs/client.key

      - name: Login to DockerHub
        uses: docker/login-action@v3
        if: inputs.do-push
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PAT }}

      - name: Push image to DockerHub
        if: inputs.do-push
        run: go run . push-images