Rebuild and Push Your Docker Image When Its Base Image Is Republished

id: base-image-update-rebuild-and-push
namespace: company.team
description: |
  Watch the digest of the base image your Dockerfile builds FROM (for example node:22-alpine) on Docker
  Hub. When the maintainers republish that tag, usually to ship OS and security patches, rebuild your
  image from Git with a fresh pull of the base, push it to your registry and tell the team in Slack.

inputs:
  - id: base_repository
    type: STRING
    displayName: Base image repository
    description: Docker Hub repository of the base image. Official images use the
      library/ prefix.
    defaults: library/node

  - id: base_tag
    type: STRING
    displayName: Base image tag
    description: The exact tag your Dockerfile uses in its FROM line.
    defaults: 22-alpine

  - id: git_url
    type: STRING
    displayName: Git repository
    description: Repository that contains your Dockerfile and build context.
    defaults: https://github.com/docker/welcome-to-docker

  - id: git_branch
    type: STRING
    displayName: Git branch
    defaults: main

  - id: dockerfile_path
    type: STRING
    displayName: Dockerfile path
    description: Path of the Dockerfile inside the repository. The repository root
      is the build context.
    defaults: Dockerfile

  - id: image
    type: STRING
    displayName: Image to push
    description: Image reference to build and push, without a tag. Pushed as latest
      and as a tag that names the base digest.
    defaults: ghcr.io/my-org/welcome-to-docker

tasks:
  - id: registry_token
    type: io.kestra.plugin.core.http.Request
    description: Anonymous pull token for the base repository on Docker Hub (no
      account needed).
    uri: "https://auth.docker.io/token?service=registry.docker.io&scope=repository:\
      {{ inputs.base_repository }}:pull"
    method: GET

  - id: base_manifest
    type: io.kestra.plugin.core.http.Request
    description: HEAD request for the tag's manifest. Docker Hub does not count HEAD
      requests against the pull rate limit.
    uri: "https://registry-1.docker.io/v2/{{ inputs.base_repository }}/manifests/{{
      inputs.base_tag }}"
    method: HEAD
    headers:
      Authorization: "Bearer {{ fromJson(outputs.registry_token.body).token }}"
      Accept: application/vnd.oci.image.index.v1+json,
        application/vnd.docker.distribution.manifest.list.v2+json,
        application/vnd.oci.image.manifest.v1+json,
        application/vnd.docker.distribution.manifest.v2+json

  - id: current
    type: io.kestra.plugin.core.output.OutputValues
    description: The current base digest, and the short form used in the image tag.
    values:
      digest: "{{ outputs.base_manifest.headers['docker-content-digest'] | first }}"
      short: "{{ outputs.base_manifest.headers['docker-content-digest'] | first |
        replace({'sha256:': ''}) | slice(0, 12) }}"

  - id: load_digest
    type: io.kestra.plugin.core.kv.Get
    description: The base image digest of the last successful build. Missing on the
      first run.
    key: "base_image_digest_{{ inputs.image | slugify }}"
    errorOnMissing: false

  - id: if_base_changed
    type: io.kestra.plugin.core.flow.If
    description: Rebuild only when the base tag points to a new digest. The first
      run records the digest without building.
    condition: "{{ (outputs.load_digest.value ?? '') != '' and
      (outputs.load_digest.value ?? '') != outputs.current.values.digest }}"
    then:
      - id: rebuild
        type: io.kestra.plugin.core.flow.WorkingDirectory
        description: Clone the source and build in the same working directory.
        tasks:
          - id: clone
            type: io.kestra.plugin.git.Clone
            description: Check out the Dockerfile and build context. Add username and
              password for a private repository.
            url: "{{ inputs.git_url }}"
            branch: "{{ inputs.git_branch }}"

          - id: build_and_push
            type: io.kestra.plugin.docker.cli.Build
            description: Build with a fresh pull of the base image, label the image with the
              base digest and push both tags.
            dockerfile: "{{ inputs.dockerfile_path }}"
            pull: true
            push: true
            tags:
              - "{{ inputs.image }}:latest"
              - "{{ inputs.image }}:base-{{ outputs.current.values.short }}"
            labels:
              org.opencontainers.image.base.name: "docker.io/{{ inputs.base_repository }}:{{ inputs.base_tag }}"
              org.opencontainers.image.base.digest: "{{ outputs.current.values.digest }}"
              org.opencontainers.image.source: "{{ inputs.git_url }}"
            credentials:
              registry: "{{ secret('REGISTRY_HOST') }}"
              username: "{{ secret('REGISTRY_USERNAME') }}"
              password: "{{ secret('REGISTRY_PASSWORD') }}"

      - id: notify_rebuilt
        type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
        description: Tell the team the image was rebuilt and why.
        url: "{{ secret('SLACK_WEBHOOK_URL') }}"
        messageText: |
          :whale: *{{ inputs.image }}* was rebuilt because `{{ inputs.base_repository | replace({'library/': ''}) }}:{{ inputs.base_tag }}` was republished.
          Base digest: `{{ outputs.load_digest.value | abbreviate(22) }}` -> `{{ outputs.current.values.digest | abbreviate(22) }}`
          Pushed `{{ inputs.image }}:latest` and `:base-{{ outputs.current.values.short }}` (image id `{{ outputs.build_and_push.imageId }}`) from {{ inputs.git_url }} ({{ inputs.git_branch }}).
          Roll it out to pick up the base image's patches.

  - id: remember_digest
    type: io.kestra.plugin.core.kv.Set
    description: Store the digest that was built. Runs after the push, so a failed
      build is retried on the next run.
    key: "base_image_digest_{{ inputs.image | slugify }}"
    overwrite: true
    value: "{{ outputs.current.values.digest }}"

errors:
  - id: alert_failure
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    description: A failed rebuild leaves the old, unpatched image in place, so say so.
    url: "{{ secret('SLACK_WEBHOOK_URL') }}"
    messageText: ":warning: Base image rebuild for {{ inputs.image }} failed in
      execution {{ execution.id }} ({{ flow.namespace }}.{{ flow.id }}). The
      image was not updated; the next run retries."

triggers:
  - id: every_six_hours
    type: io.kestra.plugin.core.trigger.Schedule
    description: Check the base tag every six hours. Disabled until the secrets are set.
    cron: "0 */6 * * *"
    disabled: true