feat(docker-build): add inputs to enable building OCI image from existing artifact

.github/workflows/docker-build.yml

@@ -59,6 +59,14 @@ on:
         description: "GitHub Actions runner label"
         default: "ubuntu-latest"
         type: string
+      artifact-name:
+        description: "Name of an artifact to download into the build context before building, e.g. a jar produced by an earlier job (leave empty to skip)"
+        default: ""
+        type: string
+      artifact-path:
+        description: "Destination path for the downloaded artifact, relative to the workspace (ignored if `artifact-name` is empty)"
+        default: ""
+        type: string
     secrets:
       dockerhub-username:
         required: true
@@ -107,10 +115,17 @@ jobs:
           echo "✅ Security report mode validation passed: $REPORT_MODE"
 
       - name: Checkout Repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Download build artifact
+        if: ${{ inputs.artifact-name != '' }}
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: ${{ inputs.artifact-name }}
+          path: ${{ inputs.artifact-path }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: Login to Docker Hub
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
@@ -127,7 +142,7 @@ jobs:
           password: ${{ secrets.password }}
 
       - name: Build Docker image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           build-args: ${{ inputs.build-args }}
           context: ${{ inputs.context }}
@@ -188,14 +203,14 @@ jobs:
 
       - name: Upload Trivy scan results to GitHub Security tab
         if: github.event_name == 'pull_request' && inputs.security-scan && inputs.security-report == 'sarif'
-        uses: github/codeql-action/upload-sarif@6f5948dfacef28e207b48d0905cf90c03365536d # v3.37.9
+        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
         with:
           sarif_file: "trivy-results.sarif"
 
       - name: Run Hadolint Dockerfile linter
         id: hadolint
         if: ${{ inputs.hadolint }}
-        uses: hadolint/hadolint-action@54c9adbab1582c2ef04b2016b760714a4bfde3cf # v3.1.0
+        uses: hadolint/hadolint-action@06be81baf89a55ffd0e24b8f04a4185738dd3387 # v3.5.0
         with:
           dockerfile: ${{ inputs.dockerfile }}
           output-file: hadolint.txt
@@ -268,7 +283,7 @@ jobs:
       # Requires the permissions id-token: write + attestations: write.
       - name: Generate & sign SLSA provenance (keyless)
         if: ${{ inputs.attest && inputs.push }}
-        uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
         with:
           subject-name: ${{ inputs.image-name }}
           subject-digest: ${{ steps.checksum.outputs.digest }}

docker-build/README.md

@@ -17,6 +17,7 @@ Perfect for teams looking to streamline their containerization workflow with min
 - 🛡️ Handles authentication securely using GitHub Secrets
 - 🚀 Optimizes build performance with layer caching
 - 📦 Supports AMD64 and ARM64 platforms (one per workflow run)
+- 📥 Optionally pulls a build artifact from an earlier job into the build context, so a compiled binary or jar can be built once and copied into the image
 
 > [!IMPORTANT]
 > Due to a limitation on Trivy analysis, the workflow targets a single platform.
@@ -26,6 +27,8 @@ Perfect for teams looking to streamline their containerization workflow with min
 
 | Name              | Description                                                                        | Required | Default           |
 | ----------------- | ---------------------------------------------------------------------------------- | -------- | ----------------- |
+| `artifact-name`   | Name of an artifact to download into the build context before building, e.g. a jar produced by an earlier job (leave empty to skip) | No | `""` |
+| `artifact-path`   | Destination path for the downloaded artifact, relative to the workspace (ignored if `artifact-name` is empty) | No | `""` |
 | `attest`          | Generate & sign a keyless SLSA build provenance attestation for the pushed image (requires `push: true` and caller permissions, see notes) | No | `false` |
 | `build-args`      | Docker build arguments (multiline format: `KEY1=value1\nKEY2=value2`)              | No       | `""`              |
 | `context`         | Path to Docker Build Context                                                       | No       | `"."`             |

docker-build/workflow-sha256

@@ -1 +1 @@
-02e205d604954431c03868fe49a190239b824e83173234bdb862a958bb63f4e3
+b90cf70ccbf64901db2b79cf2d320010efb34e714ff2e270d03ff2d181fa3845