_docker-build.yml

name: docker build

on: workflow_call

permissions:
  contents: read
  pull-requests: read

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}
  IMAGE_TAG: ${{ github.sha }}
jobs:
  build-and-push:
    runs-on: ubuntu-latest
    permissions:
      packages: write
      
    steps:
    - name: Harden Runner
      uses: step-security/harden-runner@9b0655f430fba8c7001d4e38f8d4306db5c6e0ab
      with:
        egress-policy: audit 
        
    - name: checkout repository
      uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846
    
    - name: log in to ghrc.io 
      uses: docker/#-action@1edf6180e07d2ffb423fc48a1a552855c0a1f508
      with: 
        registry: ${{ env.REGISTRY }}
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
  
    - name: build and container image
      uses: docker/build-push-action@9472e9021074a3cb3279ba431598b8836d40433f
      with:
        context: .
        push: true
        tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }}