# For GitHub Container Registry
- uses: docker/login-action@v3
  with:
    registry: ghcr.io
    username: ${{ github.actor }}
    password: ${{ secrets.GITHUB_TOKEN }}

# For AWS ECR (using OIDC)
- uses: aws-actions/configure-aws-credentials@v4
  with:
    role-to-assume: ${{ vars.AWS_BUILD_ROLE }}
    aws-region: us-east-1

# For Docker Hub
- uses: docker/login-action@v3
  with:
    username: ${{ secrets.DOCKERHUB_USERNAME }}
    password: ${{ secrets.DOCKERHUB_TOKEN }}

# Single registry
- uses: skyhook-io/docker-build-push-action@v1
  with:
    image: myregistry.io/myapp
    base_tag: v1.2.3
    # Automatically generates:
    # - myregistry.io/myapp:v1.2.3
    # - myregistry.io/myapp:sha-abc1234 (first 7 chars of commit SHA)
    # - myregistry.io/myapp:latest (if on default branch, usually 'main')

# Multiple registries (newline-delimited)
# Note: You must authenticate to each registry before this action
- uses: skyhook-io/docker-build-push-action@v1
  with:
    image: |
      ghcr.io/${{ github.repository }}
      123456789.dkr.ecr.us-east-1.amazonaws.com/myapp
      myregistry.azurecr.io/myapp
    base_tag: v1.2.3
    # Generates the same 3 tags for each registry

- uses: skyhook-io/docker-build-push-action@v1
  with:
    # Tags are newline-delimited (one per line)
    tags: |
      myregistry.io/myapp:latest
      myregistry.io/myapp:v1.2.3
      ghcr.io/${{ github.repository }}:v1.2.3
    context: .
    dockerfile: Dockerfile

# Simple case - generates v1.2.3, sha-abc1234, and latest (if on default branch)
- uses: skyhook-io/docker-build-push-action@v1
  with:
    image: ghcr.io/${{ github.repository }}
    base_tag: v${{ github.event.release.tag_name }}

# Include branch/PR tags for development builds
- uses: skyhook-io/docker-build-push-action@v1
  with:
    image: myregistry.io/myapp
    base_tag: ${{ github.ref_name }}-${{ github.run_number }}
    include_ref_tags: true  # Adds branch name or pr-123 tags

# Clean release tags only
- uses: skyhook-io/docker-build-push-action@v1
  with:
    image: myregistry.io/myapp
    base_tag: v1.2.3
    tag_sha: false       # No SHA tag
    tag_latest_on_default_branch: true  # Still add latest on default branch
    include_semver_tags: true  # Also generates '1' and '1.2' tags

# Authenticate to each registry first
- uses: docker/login-action@v3
  with:
    registry: ghcr.io
    username: ${{ github.actor }}
    password: ${{ secrets.GITHUB_TOKEN }}

- uses: skyhook-io/cloud-login@v1
  with:
    provider: aws
    region: us-east-1
    aws_role_to_assume: ${{ vars.AWS_BUILD_ROLE }}
    login_to_container_registry: true

# Then push to all registries with the same tags
- uses: skyhook-io/docker-build-push-action@v1
  with:
    image: |
      ghcr.io/${{ github.repository }}
      123456789.dkr.ecr.us-east-1.amazonaws.com/myapp
    base_tag: v1.2.3

- uses: skyhook-io/docker-build-push-action@v1
  with:
    tags: myregistry.io/myapp:latest
    platforms: linux/amd64,linux/arm64,linux/arm/v7
    push: true

- uses: skyhook-io/docker-build-push-action@v1
  with:
    tags: myregistry.io/myapp:${{ github.sha }}
    build_args: |
      VERSION=${{ github.ref_name }}
      BUILD_DATE=${{ github.event.head_commit.timestamp }}
      VCS_REF=${{ github.sha }}

- uses: skyhook-io/docker-build-push-action@v1
  with:
    tags: myregistry.io/myapp:test
    target: test
    load: true  # Load for local testing
    push: false

strategy:
  matrix:
    include:
      - registry: ghcr.io
        image: ${{ github.repository }}
      - registry: docker.io
        image: myorg/myapp

steps:
  - uses: skyhook-io/docker-build-push-action@v1
    with:
      tags: ${{ matrix.registry }}/${{ matrix.image }}:${{ github.ref_name }}

- id: build
  uses: skyhook-io/docker-build-push-action@v1
  with:
    tags: myregistry.io/myapp:v1.2.3

- name: Deploy image
  run: |
    echo "Deploying images:"
    echo "${{ steps.build.outputs.tags_list }}"
    # Use the digest for immutable reference
    kubectl set image deployment/myapp app=myregistry.io/myapp@${{ steps.build.outputs.digest }}

# Generate SBOM and provenance for supply chain security
- uses: skyhook-io/docker-build-push-action@v1
  with:
    image: myregistry.io/myapp
    base_tag: v1.2.3
    provenance: true  # Generate provenance attestation
    sbom: true        # Generate SBOM attestation

# Configure buildx with custom driver and settings
- uses: skyhook-io/docker-build-push-action@v1
  with:
    image: myregistry.io/myapp
    base_tag: v1.2.3
    buildx_driver: docker-container
    buildx_driver_opts: |
      network=host
      image=moby/buildkit:v0.12.0
    buildx_install: true
    buildx_platforms: linux/amd64,linux/arm64

# Use remote BuildKit instance
- uses: skyhook-io/docker-build-push-action@v1
  with:
    image: myregistry.io/myapp
    base_tag: v1.2.3
    buildx_driver: remote
    buildx_endpoint: tcp://buildkit.example.com:8125

# Configure buildx with specific builder instance
- uses: skyhook-io/docker-build-push-action@v1
  with:
    image: myregistry.io/myapp
    base_tag: v1.2.3
    buildx_name: my-custom-builder
    buildx_driver: kubernetes
    buildx_driver_opts: |
      namespace=buildkit
      replicas=2
    buildx_use: true

# Use specific buildx version with custom flags
- uses: skyhook-io/docker-build-push-action@v1
  with:
    image: myregistry.io/myapp
    base_tag: v1.2.3
    buildx_version: v0.11.2
    buildx_buildkitd_flags: --debug --allow-insecure-entitlement network.host
    buildx_install: true

- uses: docker/build-push-action@v5
  with:
    tags: |
      user/repo:latest
      user/repo:${{ github.sha }}

- uses: skyhook-io/docker-build-push-action@v1
  with:
    tags: |
      user/repo:latest
      user/repo:${{ github.sha }}