image-build/README.md

# action/image-build

Composite Gitea Action that builds a container image with buildx and optionally
runs a smoke test. **Does not push** — pair with `action/image-push` to publish.

Splitting build from push lets a PR workflow run `image-build` (no secrets, no
side effects) for validation while `main` runs the full build → push → deploy
chain.

## Usage

```yaml
- uses: actions/checkout@v4
- uses: https://code.fritzlab.net/action/image-build@v1
  with:
    image: code.fritzlab.net/fritzlab/chrony
    smoke-test: docker run --rm --entrypoint /usr/sbin/chronyd $IMAGE -v
```

The image is built and tagged as `<image>:<github.run_number>` in the runner's
local Docker daemon. Subsequent steps (e.g. `action/image-push`) can reference
the same tag.

## Inputs

| Name | Required | Default | Description |
|---|---|---|---|
| `image` | yes | — | Full image name without tag (e.g. `code.fritzlab.net/fritzlab/chrony`). |
| `context` | no | `.` | Docker build context. |
| `dockerfile` | no | `Dockerfile` (in context) | Path to the Dockerfile, relative to the context (or absolute under `$GITHUB_WORKSPACE`). Use for monorepos where the build context is the repo root but the Dockerfile lives in a subdir, e.g. `dockerfile: api/Dockerfile`. |
| `build-args` | no | — | Multiline `KEY=VALUE` build args. Visible in `docker history` — never put secrets here. |
| `secrets` | no | — | Multiline `id=VALUE` BuildKit secrets (`--secret`). For tokens the build needs (e.g. a ci-bot token to `go mod download` a private module) that must not leak into layers. Reference with `RUN --mount=type=secret,id=<id>`. |
| `smoke-test` | no | — | Shell command run after build. `$IMAGE` is set to `<image>:<run_number>`. Non-zero exit fails the action. |

## Outputs

| Name | Description |
|---|---|
| `tag` | Numeric tag assigned (= `github.run_number`). |

## Smoke test patterns

Override entrypoint for a binary that expects no args:

```yaml
smoke-test: docker run --rm --entrypoint /usr/sbin/chronyd $IMAGE -v
```

Run a help command that returns non-zero:

```yaml
smoke-test: docker run --rm $IMAGE --help || true
```

Multiple checks chained:

```yaml
smoke-test: |
  docker run --rm $IMAGE --version
  docker run --rm --entrypoint /bin/sh $IMAGE -c 'test -x /usr/local/bin/myapp'
```