maybe-build.yaml

name: 📜 Check if we need to build a new image due to the base image update
on:
  workflow_call:
    inputs:
      image:
        description: Image (user/name:tag) to check
        required: true
        type: string
      recipe:
        description: Recipe file to use for the build
        required: true
        type: string
    secrets:
      SIGNING_SECRET:
        required: true

concurrency:
  group: maybe-${{ inputs.recipe }}
  cancel-in-progress: true

jobs:
  check:
    name: Check if there's a new version of the base image
    runs-on: ubuntu-latest
    outputs:
      needs_rebuild: ${{ steps.compare.outputs.verdict == 'true' }}
    steps:
      - name: Interrogate docker repository about ${{ inputs.image }}
        id: compare
        run: |
          LATEST_BUILD_BASE_SHA=$(skopeo inspect docker://ghcr.io/${{ inputs.image }} | jq -r '.Labels."org.opencontainers.image.base.digest"')
          BASE_IMAGE=$(skopeo inspect docker://ghcr.io/${{ inputs.image }} | jq -r '.Labels."org.opencontainers.image.base.name"')
          LATEST_BASE_SHA=$(skopeo inspect docker://${BASE_IMAGE} | jq -r '.Digest' )
          echo "Digest of ${BASE_IMAGE} from which latest ${{ inputs.image }} was built: [${LATEST_BUILD_BASE_SHA}]"
          echo "${BASE_IMAGE} is currently at [${LATEST_BASE_SHA}]"
          VERDICT=$([ "${LATEST_BUILD_BASE_SHA}" != "${LATEST_BASE_SHA}" ] && echo "true" || echo "false")
          echo "### Rebuild needed: ${VERDICT}" >> ${GITHUB_STEP_SUMMARY}
          echo "verdict=${VERDICT}" >> ${GITHUB_OUTPUT}

  build:
    permissions:
      contents: read
      packages: write
      id-token: write
    name: Build a custom image
    needs: check
    if: needs.check.outputs.needs_rebuild == 'true'
    secrets:
      SIGNING_SECRET: ${{ secrets.SIGNING_SECRET }}
    uses: ./.github/workflows/build.yaml
    with:
      recipe: ${{ inputs.recipe }}