docker-build-action

Build and push container images with docker buildx on Forgejo Actions runners. A docker/build-push-action-style wrapper that defaults the build context to the checked-out workspace (never https://github.com/<owner>/<repo>.git) and works with any OCI registry. Composite action, pure shell, no build step.

Quick start

jobs:
  image:
    runs-on: [self-hosted, Linux]
    steps:
      - uses: actions/checkout@v6
      - uses: https://rasterhub.com/rasterstate/docker-build-action@v1
        with:
          tags: rasterhub.com/myorg/app:latest
          push: true
          registry: rasterhub.com
          username: ${{ secrets.FORGEJO_USER }}
          password: ${{ secrets.FORGEJO_TOKEN }}

Inputs

Close to docker/build-push-action.

Input	Default	Description
context	.	Build context: a path (workspace), a git URL, or <url>#ref:subdir.
file		Dockerfile path.
tags		Image tags, one per line.
labels		Labels, one per line.
build-args		KEY=VALUE, one per line.
build-contexts		Named build contexts as name=ref, one per line (--build-context).
secrets / ssh		buildx --secret / --ssh specs, one per line.
platforms		Comma list, e.g. linux/amd64,linux/arm64.
target		Target build stage.
cache-from / cache-to		BuildKit cache specs, one per line.
outputs		buildx --output exporter specs, one per line.
push / load	false	Push to the registry / load into the local image store.
pull / no-cache	false	Pull newer bases / disable cache.
provenance / sbom		Attestation values passed to buildx.
extra-args		Extra buildx args, space-separated. Values are passed as separate argv entries; shell quoting is not interpreted.
registry / username / password		Optional docker login before building. Empty registry is Docker Hub.

Outputs

Output	Description
imageid	The built image id.
digest	The image digest (when pushed).
metadata	The buildx metadata JSON.

Context: never github.com

docker/build-push-action defaults context to the repository's git context, which on GitHub resolves to a github.com URL. This action defaults to . (the directory you checked out), so it builds your Forgejo-hosted source with no github.com dependency. For an explicit git context, set context to your Forgejo repo URL, optionally with a subdir:

with:
  context: https://rasterhub.com/myorg/app.git#main:services/api

Registries

The login inputs are registry-agnostic:

• Docker Hub: leave registry empty.
• GHCR: registry: ghcr.io.
• Forgejo package registry: registry: <your-forgejo-host> with a token.
• Any OCI registry: set registry to its host.

Or run a separate login step and omit these inputs.

BuildKit cache

Pass-through to buildx, so any backend works:

with:
  cache-from: type=registry,ref=rasterhub.com/myorg/app:buildcache
  cache-to: type=registry,ref=rasterhub.com/myorg/app:buildcache,mode=max

• registry cache: shown above; portable across runners.
• local cache: type=local,src=/mnt/bk-cache / type=local,dest=/mnt/bk-cache,mode=max (good with a shared mount).
• s3 cache: type=s3,region=...,bucket=... with credentials in the job env, if your BuildKit supports the s3 exporter.

Outputs and build contexts

outputs maps to buildx --output (one exporter per line), so you can produce artifacts other than a registry push, such as a local directory or a tarball:

with:
  outputs: |
    type=local,dest=out
    type=tar,dest=image.tar

build-contexts maps to --build-context name=ref (one per line). Each ref may be a path, an image, a git URL, or another build stage, which is handy for monorepos and multi-context Dockerfiles (FROM vendor, COPY --from=app):

with:
  build-contexts: |
    app=./services/app
    vendor=../vendor
    base=docker-image://alpine:3.20

Each line is passed to buildx as a single quoted argument (no shell word splitting); build-contexts entries must be name=ref.

Requirements

• docker with the buildx plugin on the runner. The action ensures a builder exists.

Examples

See examples/workflows: build-only, build-and-push, registry cache, local cache, and Forgejo-hosted source.

Migrating from docker/build-push-action

See MIGRATION.md.

License

MIT. See LICENSE.