name: Kaniko build and push
description: >-
  Build a container image from the checked-out repository with Kaniko and push it to any
  registry. Needs no Docker daemon, no root on the runner and no privileged mode, and leaves
  nothing behind on the runner's disk.
author: scotty-git

inputs:
  destination:
    description: >-
      Image reference(s) to push, separated by commas or new lines,
      e.g. "git.scotty-world.com/my-org/my-app:1.2.3". Required unless push is "false".
    required: false
    default: ""
  context:
    description: Build context, relative to the repository root.
    required: false
    default: "."
  dockerfile:
    description: Path to the Dockerfile, relative to the repository root.
    required: false
    default: "Dockerfile"
  push:
    description: '"false" builds the image but does not push it (useful for PR checks).'
    required: false
    default: "true"
  registry:
    description: >-
      Registry host the credentials below are for, e.g. "git.scotty-world.com",
      "asia-south1-docker.pkg.dev", "ghcr.io". Defaults to the host of the first destination.
    required: false
    default: ""
  username:
    description: Registry username. Use with password.
    required: false
    default: ""
  password:
    description: Registry password or token. Pass it from a secret, never as plain text.
    required: false
    default: ""
  gcp_key_json:
    description: >-
      Google service-account key JSON for Artifact Registry, instead of username/password.
      Pass it from a secret.
    required: false
    default: ""
  cache_repo:
    description: >-
      Registry repository for Kaniko's layer cache, e.g. "git.scotty-world.com/my-org/my-app-cache".
      Makes rebuilds fast without storing anything on the runner. Leave empty for no cache.
    required: false
    default: ""
  build_args:
    description: Build arguments, one KEY=VALUE per line.
    required: false
    default: ""
  extra_args:
    description: Extra Kaniko executor flags, space-separated (advanced).
    required: false
    default: ""

outputs:
  digest:
    description: The sha256 digest of the pushed image (empty when push is "false").

runs:
  using: docker
  image: Dockerfile