michielvha/Build and release a Docker Image

A reusable action to build and release Docker images with automatic version detection

View on GitHub

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Activelast commit Jun 6, 2026
License: Apache 2.0

Pinned Snippet

workflow.ymlSHA-pinned

uses: michielvha/docker-release-action@e7bb601b3297b74c958e4f36fef697f28febbadc # v1

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
version	GitVersion version to use	no	dev
username	Docker Hub username	yes	—
password	Docker Hub password or token	yes	—
project	Docker image name (e.g., edgeforge/erm)	yes	—
platforms	Target platforms for Docker build	no	linux/amd64
context	Docker build context	no	.
build-args	Additional build arguments to pass to Docker build (multiline string, e.g., "ARG1=value1\nARG2=value2"). IMAGE_NAME will be automatically set to the project name.	no	—
registry	optionally specify any OCI complaint registry, common ones include docker.io, ghcr.io, gcr.io, quay.io, defaults to docker hub.	—	docker.io
cache-from	List of external cache sources for BuildKit (e.g. "type=gha,scope=my-workflow"). Leave empty to disable caching.	no	""
cache-to	List of cache export destinations for BuildKit (e.g. "type=gha,scope=my-workflow,mode=max"). Leave empty to disable caching.	no	""
secret-files	BuildKit secret files to mount during build (e.g., "netrc=.netrc"). Maps directly to docker/build-push-action secret-files input. Use with RUN --mount=type=secret in Dockerfiles.	no	""
matrix-mode	Enable native multi-platform matrix builds. Use "build" in each matrix leg to push a single-platform image by digest, then "merge" in a follow-up job to combine digests into a multi-arch manifest. Leave empty for default single-job behavior (backward compatible).	no	""
trivy-scan	Enable Trivy vulnerability scanning of the built image	no	true
trivy-severity	Trivy severity levels to report (comma-separated)	no	HIGH,CRITICAL
trivy-exit-code	Exit code when vulnerabilities are found (0 = report only, 1 = fail)	no	0
trivy-format	Trivy output format (table, json, sarif, cyclonedx, spdx-json) - sarif requires `security-events: write` permission and GHAS enabled (pro feature)	no	table
cosign-sign	Enable Sigstore keyless signing (cosign sign) of the pushed image digest. Requires the calling job to declare `id-token: write` permission. Opt-in for backward compatibility.	no	false
sbom	Generate an SPDX-JSON SBOM for the built image with Syft and upload it as a workflow artifact. Opt-in for backward compatibility.	no	false
attest-provenance	Produce a SLSA build-provenance attestation (actions/attest-build-provenance) bound to the pushed image digest. Requires the calling job to declare `id-token: write` + `attestations: write` permissions. Opt-in.	no	false
attest-sbom	Produce an SBOM attestation (actions/attest-sbom) bound to the pushed image digest. Requires `id-token: write` + `attestations: write` permissions and `sbom: true`. Opt-in.	no	false
vex	Path to an OpenVEX document (https://openvex.dev) to attach to the released image. Leave empty to skip. The document is authored/maintained out-of-band (e.g. with vexctl) and committed to the calling repository.	no	""
attest-vex	Produce an OpenVEX attestation (actions/attest, predicate-type https://openvex.dev/ns/v0.2.0) bound to the pushed image digest. Requires `id-token: write` + `attestations: write` permissions and a non-empty `vex` path. Opt-in for backward compatibility.	no	false

Outputs

name	description
image-digest	Docker image digest of the pushed manifest (default-mode build) or single-platform leg (build-mode). For merge-mode, see release-digest.
release-digest	Digest of the final released artifact: the manifest in merge-mode, the pushed image in default mode, empty in build-mode.