feat(build): add build_context_from_working_dir for independent modules (#165)

* feat(build): add build_context_from_working_dir input for independent modules

Adds a new boolean input to build.yml and pr-security-scan.yml that uses
the component working_dir as Docker build context instead of the repo root.
This enables building tools/services with their own go.mod without
conflicting with the main project dependencies.

* fix(gitops): change enable_docker_login default to false

GitOps updates only modify YAML files in the gitops repo and do not
pull or push Docker images. Docker login is unnecessary by default
and can be explicitly enabled when needed.

* fix(gitops): remove trailing spaces and add cd guard for shellcheck

Fix pre-existing lint issues:
- Remove trailing whitespace from 17 lines
- Add || exit 1 to cd commands (SC2164)

Author: bedatty

.github/workflows/build.yml

@@ -122,6 +122,10 @@ on:
         description: 'Force multi-platform build (amd64+arm64) even for beta/rc tags'
         type: boolean
         default: false
+      build_context_from_working_dir:
+        description: 'Use the component working_dir as Docker build context instead of build_context. Useful for independent modules (e.g., tools with their own go.mod).'
+        type: boolean
+        default: false
 
 permissions:
   contents: read
@@ -281,7 +285,7 @@ jobs:
       - name: Build and push Docker image
         uses: docker/build-push-action@v7
         with:
-          context: ${{ inputs.build_context }}
+          context: ${{ inputs.build_context_from_working_dir == true && matrix.app.working_dir || inputs.build_context }}
           file: ${{ matrix.app.working_dir }}/${{ inputs.dockerfile_name }}
           platforms: ${{ needs.prepare.outputs.platforms }}
           push: true

.github/workflows/gitops-update.yml

@@ -52,9 +52,9 @@ on:
         type: string
         default: 'v4.44.3'
       enable_docker_login:
-        description: 'Enable Docker Hub login to avoid rate limits'
+        description: 'Enable Docker Hub login to avoid rate limits. Disabled by default since GitOps updates do not require Docker registry access.'
         type: boolean
-        default: true
+        default: false
       configmap_updates:
         description: 'JSON object mapping artifact names to configmap keys (e.g., {"pix.tag": ".pix.configmap.VERSION"})'
         type: string
@@ -104,7 +104,7 @@ jobs:
           # Determine which servers to deploy to
           DEPLOY_FIRMINO="${{ inputs.deploy_in_firmino }}"
           DEPLOY_CLOTILDE="${{ inputs.deploy_in_clotilde }}"
-          
+
           echo "deploy_firmino=$DEPLOY_FIRMINO" >> "$GITHUB_OUTPUT"
           echo "deploy_clotilde=$DEPLOY_CLOTILDE" >> "$GITHUB_OUTPUT"
           echo "Deploy to Firmino: $DEPLOY_FIRMINO"
@@ -144,7 +144,7 @@ jobs:
         shell: bash
         run: |
           set -e
-          cd gitops
+          cd gitops || exit 1
           git pull origin main
 
       - name: Cleanup old artifacts (self-hosted runner safety)
@@ -179,25 +179,25 @@ jobs:
         shell: bash
         run: |
           echo "Checking for downloaded artifacts..."
-          
+
           # Check if directory exists and has files
           if [[ ! -d ".gitops-tags" ]]; then
             echo "::error::No artifacts directory found. Build job may have been skipped or failed to produce artifacts."
             echo "artifacts_valid=false" >> "$GITHUB_OUTPUT"
             exit 1
           fi
-          
+
           # Count actual artifact files (not directories)
           ARTIFACT_COUNT=$(find .gitops-tags -type f -name "*.tag" 2>/dev/null | wc -l || echo "0")
-          
+
           if [[ "$ARTIFACT_COUNT" -eq 0 ]]; then
             echo "::error::No artifact files found in .gitops-tags/. Build job may have been skipped or failed."
             echo "Directory contents:"
             ls -laR .gitops-tags/ 2>/dev/null || echo "Directory is empty or doesn't exist"
             echo "artifacts_valid=false" >> "$GITHUB_OUTPUT"
             exit 1
           fi
-          
+
           echo "Found $ARTIFACT_COUNT artifact file(s):"
           ls -la .gitops-tags/
           echo "artifacts_valid=true" >> "$GITHUB_OUTPUT"
@@ -210,7 +210,7 @@ jobs:
 
           # Get app name
           APP_NAME="${{ steps.setup.outputs.app_name }}"
-          
+
           # Determine environments to update based on tag type
           if [[ "${{ env.IS_BETA }}" == "true" ]]; then
             ENVIRONMENTS="dev"
@@ -244,7 +244,7 @@ jobs:
               SERVERS="clotilde"
             fi
           fi
-          
+
           if [[ -z "$SERVERS" ]]; then
             echo "No servers selected for deployment. Enable deploy_in_firmino or deploy_in_clotilde."
             exit 1
@@ -262,7 +262,7 @@ jobs:
               AVAILABLE_ARTIFACTS="${AVAILABLE_ARTIFACTS}${artifact_name} "
             fi
           done
-          
+
           if [[ -z "$AVAILABLE_ARTIFACTS" ]]; then
             echo "No artifacts found in .gitops-tags/"
             echo "sync_matrix=[]" >> "$GITHUB_OUTPUT"
@@ -280,10 +280,10 @@ jobs:
             local file="$1"
             local yaml_path="$2"
             local new_tag="$3"
-            
+
             # Extract the key name from yaml path (e.g., ".image.tag" -> "tag")
             local key_name="${yaml_path##*.}"
-            
+
             # Use sed to replace only the tag value, preserving all formatting
             # This handles patterns like "tag: v1.0.0" or "tag: 'v1.0.0'" or 'tag: "v1.0.0"'
             if grep -q "^[[:space:]]*${key_name}:" "$file"; then
@@ -298,21 +298,21 @@ jobs:
           for SERVER in $SERVERS; do
             for ENV in $ENVIRONMENTS; do
               VALUES_FILE="gitops/environments/${SERVER}/helmfile/applications/${ENV}/${APP_NAME}/values.yaml"
-              
+
               echo ""
               echo "Processing: $SERVER/$ENV"
               echo "  Path: $VALUES_FILE"
-              
+
               # Check if file exists
               if [[ ! -f "$VALUES_FILE" ]]; then
                 echo "  WARNING: Values file not found for ${SERVER}/${ENV}: ${VALUES_FILE}"
                 MISSING_FILES="${MISSING_FILES}${SERVER}/${ENV}:${VALUES_FILE}\n"
                 continue
               fi
-              
+
               # Track if any changes were made to this file
               FILE_CHANGED=false
-              
+
               # Apply mappings from inputs - only if artifact exists
               MAPPINGS='${{ inputs.yaml_key_mappings }}'
               while IFS='|' read -r artifact_key yaml_key; do
@@ -334,7 +334,7 @@ jobs:
                   fi
                 fi
               done < <(echo "$MAPPINGS" | jq -r 'to_entries[] | "\(.key)|\(.value)"')
-              
+
               # Apply configmap updates if configured - only if artifact exists
               if [[ -n "${{ inputs.configmap_updates }}" ]]; then
                 CONFIGMAP_MAPPINGS='${{ inputs.configmap_updates }}'
@@ -356,7 +356,7 @@ jobs:
                   fi
                 done < <(echo "$CONFIGMAP_MAPPINGS" | jq -r 'to_entries[] | "\(.key)|\(.value)"')
               fi
-              
+
               # Only track as updated if changes were actually made
               if [[ "$FILE_CHANGED" == "true" ]]; then
                 UPDATED_FILES="${UPDATED_FILES}${VALUES_FILE}\n"
@@ -378,7 +378,7 @@ jobs:
           else
             echo "No files were updated"
           fi
-          
+
           if [[ -n "$MISSING_FILES" ]]; then
             echo ""
             echo "Missing files (skipped):"
@@ -388,7 +388,7 @@ jobs:
           # Save updated servers/envs for ArgoCD sync - only include files that actually changed
           if [[ -n "$UPDATED_SERVERS_ENVS" ]]; then
             echo -e "$UPDATED_SERVERS_ENVS" | grep -v '^$' > /tmp/updated_servers_envs.txt
-            
+
             # Output sync targets as JSON array for matrix job
             SYNC_MATRIX=$(echo -e "$UPDATED_SERVERS_ENVS" | grep -v '^$' | while IFS=: read -r s e; do
               [[ -n "$s" && -n "$e" ]] && echo "{\"server\":\"$s\",\"env\":\"$e\"}"
@@ -400,7 +400,7 @@ jobs:
             echo "sync_matrix=[]" >> "$GITHUB_OUTPUT"
             echo "has_sync_targets=false" >> "$GITHUB_OUTPUT"
           fi
-          
+
           COUNT=0
           if [[ -n "$UPDATED_FILES" ]]; then
             COUNT=$(echo -e "$UPDATED_FILES" | grep -c -v '^$' || true)
@@ -410,7 +410,7 @@ jobs:
       - name: Show git diff
         shell: bash
         run: |
-          cd gitops
+          cd gitops || exit 1
           echo "Changes to be committed:"
           git diff --stat
           echo ""
@@ -432,17 +432,17 @@ jobs:
       - name: Commit & push (GitOps)
         run: |
           set -e
-          cd gitops
-          
+          cd gitops || exit 1
+
           # Get env label from apply_tags step
           ENV_LABEL="${{ steps.apply_tags.outputs.env_label }}"
-          
+
           # Check if there are changes to commit
           if git diff --quiet; then
             echo "No changes to commit"
             exit 0
           fi
-          
+
           git commit -am "ci(${{ steps.setup.outputs.commit_prefix }}): update image tags ($ENV_LABEL)" || echo "No changes to commit"
           git push origin main
 

.github/workflows/pr-security-scan.yml

@@ -67,6 +67,10 @@ on:
         description: 'Enable Docker Hub Health Score compliance checks (non-root user, CVEs, licenses)'
         type: boolean
         default: true
+      build_context_from_working_dir:
+        description: 'Use the component working_dir as Docker build context instead of repo root. Useful for independent modules (e.g., tools with their own go.mod).'
+        type: boolean
+        default: false
 
 permissions:
   id-token: write       # Required for OIDC authentication
@@ -151,7 +155,7 @@ jobs:
         if: always() && inputs.enable_docker_scan
         uses: docker/build-push-action@v7
         with:
-          context: ${{ inputs.monorepo_type == 'type2' && matrix.working_dir == inputs.frontend_folder && inputs.frontend_folder || '.' }}
+          context: ${{ inputs.build_context_from_working_dir == true && matrix.working_dir || (inputs.monorepo_type == 'type2' && matrix.working_dir == inputs.frontend_folder && inputs.frontend_folder || '.') }}
           file: ${{ env.DOCKERFILE_PATH }}
           platforms: linux/amd64
           load: true